I changed the traefik HelmChartConfig so that the constructed LoadBalancer service set

externalTrafficPolicy: Local

. This does the right thing for traffic that comes in on one of the 3 nodes where I have traefik running. Traefik correctly sees the raw source IP/port, and can correctly maintain the mapping to the same replica.