3 ms·

Load balancers have never been part of Kubernetes. Service and Ingress are just routing rules. Service with ClusterIP creates an internal IP that redirects tra

Load balancers have never been part of Kubernetes. Service and Ingress are just routing rules. Service with ClusterIP creates an internal IP that redirects traffic to that service's pods. Service with NodePort creates a CluserIP and creates a port on every node that lets external traffic also reach those pods. Service with LoadBalancer creates a ClusterIP, NodePort, and a whatever load balancer implementation exists in that cloud to route external traffic to those K8S nodes and nodeport port numbers. This is the part that's missing in your bare metal setup, but you can create a nodeport service using port 80/443 and have DNS pointing to your nodes' public addresses. That's all it takes to get cluster access and you can point this Service to another downstream Service/Ingress if you want the routing rules to stay in YAML too.

intricatedetail 6y ago
That's why it is kind of pointless on self hosted environment, as you can't create an IP and a hostname that can be accessed from outside world. You have to manually do a reverse proxy to whatever ip has been added in the private network. If you use K8s on AWS or GCP then your services automatically are accessible from outside world. There were attempts to make Nginx or similar LB working with virtual hosts but never seen that working in practice. It seems like developers keep it enterprisey so that people keep using and be locked in to the cloud.
- manigandham 6y ago
  What does self-hosted mean? Do any of your nodes have a public IP address? If so then I explained exactly how they can be accessed. If all of your nodes are private and behind some kind of firewall or virtual network then yes you'll have to make a public bridge, otherwise just point the DNS to your nodes. You can use a Deployment with the standard ports 80/443 to avoid any port translation too. That's all the clouds do anyway, they just run a bunch of load balancers that move external traffic to the nodes of your K8S cluster with the port specified in the Ingress/Service and K8S takes it from there. There's no shortcut, the traffic has to be routed somehow so if you don't use a managed service then you have to do it yourself. It's got nothing to do with "developers keep it enterprisey". Here's an answer I wrote about skipping GKE's cloud LB to accomplish the same thing: https://stackoverflow.com/a/54297777/173322 https://stackoverflow.com/a/54297777/173322 Also try using Ambassador as a reverse proxy/ingress/LB. It uses Envoy and is much faster and more configurable. You can set it to use the host network on your nodes and skip the K8S cluster mapping: https://www.getambassador.io/ https://www.getambassador.io/
  - intricatedetail 6y ago
    None of these examples work for self hosted scenario where you have one public IP (or a few statically assigned to your server). If you want to host a service the traditional way, you create a virtual host and a reverse proxy to your container (that is on a private network) or a service bound to a local IP. Currently I couldn't find a way to automate that. Let's say that could be done by a LoadBalancer, that is in fact controlling virtual hosts and reverse proxy entries for the pool of available IP addresses. For hostnames, there would be a pool of domains configured to resolve any host to that one IP.
    - manigandham 6y ago
      Yes they do, I've run it that way along with many others. Virtual hosts are easily supported. You should read up on the K8S documentation because it seems you're unfamiliar with the K8S constructs. What you're looking for is called an Ingress, which is like a Service that has more advanced routing specifically designed to support multiple hosts and backends from one "ingress" point for the cluster. The Ingress (again a set of routing rules) can be implemented by many different proxies like Nginx, HAProxy, Traefix, Caddy, etc. Or you can use Ambassador like I mentioned which bypasses the K8S Ingress and uses its own streamlined config with better performance, observability and automated HTTPS too.

intricatedetail 6y ago

That's why it is kind of pointless on self hosted environment, as you can't create an IP and a hostname that can be accessed from outside world. You have to manually do a reverse proxy to whatever ip has been added in the private network. If you use K8s on AWS or GCP then your services automatically are accessible from outside world. There were attempts to make Nginx or similar LB working with virtual hosts but never seen that working in practice. It seems like developers keep it enterprisey so that people keep using and be locked in to the cloud.

manigandham 6y ago
What does self-hosted mean? Do any of your nodes have a public IP address? If so then I explained exactly how they can be accessed. If all of your nodes are private and behind some kind of firewall or virtual network then yes you'll have to make a public bridge, otherwise just point the DNS to your nodes. You can use a Deployment with the standard ports 80/443 to avoid any port translation too. That's all the clouds do anyway, they just run a bunch of load balancers that move external traffic to the nodes of your K8S cluster with the port specified in the Ingress/Service and K8S takes it from there. There's no shortcut, the traffic has to be routed somehow so if you don't use a managed service then you have to do it yourself. It's got nothing to do with "developers keep it enterprisey". Here's an answer I wrote about skipping GKE's cloud LB to accomplish the same thing: https://stackoverflow.com/a/54297777/173322 https://stackoverflow.com/a/54297777/173322 Also try using Ambassador as a reverse proxy/ingress/LB. It uses Envoy and is much faster and more configurable. You can set it to use the host network on your nodes and skip the K8S cluster mapping: https://www.getambassador.io/ https://www.getambassador.io/
- intricatedetail 6y ago
  None of these examples work for self hosted scenario where you have one public IP (or a few statically assigned to your server). If you want to host a service the traditional way, you create a virtual host and a reverse proxy to your container (that is on a private network) or a service bound to a local IP. Currently I couldn't find a way to automate that. Let's say that could be done by a LoadBalancer, that is in fact controlling virtual hosts and reverse proxy entries for the pool of available IP addresses. For hostnames, there would be a pool of domains configured to resolve any host to that one IP.
  - manigandham 6y ago
    Yes they do, I've run it that way along with many others. Virtual hosts are easily supported. You should read up on the K8S documentation because it seems you're unfamiliar with the K8S constructs. What you're looking for is called an Ingress, which is like a Service that has more advanced routing specifically designed to support multiple hosts and backends from one "ingress" point for the cluster. The Ingress (again a set of routing rules) can be implemented by many different proxies like Nginx, HAProxy, Traefix, Caddy, etc. Or you can use Ambassador like I mentioned which bypasses the K8S Ingress and uses its own streamlined config with better performance, observability and automated HTTPS too.