Expose port 80 on Digital Ocean's managed Kubernetes without a load balancer

Question

I would like to expose my Kubernetes Managed Digital Ocean (single node) cluster's service on port 80 without the use of Digital Ocean's load balancer. Is this possible? How would I do this?

This is essentially a hobby project (I am beginning with Kubernetes) and just want to keep the cost very low.

Thank you in advance! -Joe

Answer 1

You can deploy an Ingress configured to use the host network and port 80/443.

1. DO's firewall for your cluster doesn't have 80/443 inbound open by default. Open them at https://cloud.digitalocean.com/networking/firewalls

2. Create the nginx ingress using the host network. I've included the helm chart config below, but you could do it via the direct install process too.

$ helm install stable/nginx-ingress --name=myingress -f myingress.values.yml

myingress.values.yml for the chart:

---
controller:
  kind: DaemonSet
  hostNetwork: true
  dnsPolicy: ClusterFirstWithHostNet
  daemonset:
    useHostPort: true
  service:
    type: ClusterIP
rbac:
  create: true

3. you should be able to access the cluster on :80 and :443 via any worker node IP and it'll route traffic to your ingress.

4. since node IPs can & do change, look at deploying external-dns to manage DNS entries to point to your worker nodes. Again, using the helm chart and assuming your DNS domain is hosted by DigitalOcean (though any supported DNS provider will work):

$ helm install --name=mydns -f mydns.values.yml stable/external-dns

mydns.values.yml for the chart:

---
provider: digitalocean
digitalocean:
  # create the API token at https://cloud.digitalocean.com/account/api/tokens
  # needs read + write
  apiToken: "DIGITALOCEAN_API_TOKEN"
domainFilters:
  # domains you want external-dns to be able to edit
  - example.com
rbac:
  create: true

5. create a Kubernetes Ingress resource to route requests to an existing Kubernetes service:

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: testing123-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
    - host: testing123.example.com             # the domain you want associated
      http:
        paths:
          - path: /
            backend:
              serviceName: testing123-service  # existing service
              servicePort: 8000                # existing service port

6. after a minute or so you should see the DNS records appear and be resolvable:

$ dig testing123.example.com             # should return worker IP address
$ curl -v http://testing123.example.com  # should send the request through the Ingress to your backend service

Answer 2

A NodePort Service can do what you want. Something like this:

kind: Service
apiVersion: v1
metadata:
  name: my-service
spec:
  type: NodePort
  selector:
    app: MyApp
  ports:
  - protocol: TCP
    nodePort: 80
    targetPort: 80

This will redirect incoming traffic from port 80 of the node to port 80 of your pod. Publish the node IP in DNS and you're set.

In general exposing a service to the outside world like this is a very, very bad idea, because the single node passing through all traffic to the service is both going to receive unbalanced load and be a single point of failure. That consideration doesn't apply to a single-node cluster, though, so with the caveat that LoadBalancer and Ingress are the fault-tolerant ways to do what you're looking for, NodePort is best for this extremely specific case.