Simplest/cleanest way to expose kubernetes services to the public
internet?
reddit / selfhosted

----------------------------------------------------------------------
GWBrooks · 2023-12-03 04:29

I have a new k3s cluster in Proxmox and have a basic/dumb issue:
What's the best way to route requests from the host's single public IP
to the private-IP-space K3s nodes?

I'm using Kube-VIP to provide a single virtual IP for the cluster, but
I'm not married to that approach; I tried putting Opnsense with the
HAProxy plugin in front of everything, but setting up each service's
reverse proxy seems to take a lot of steps and, in any case, I could
never get it to work.

What's everyone doing that's smarter? I've thought about forwarding a
public IP address (I have several available) to the Kube-VIP virtual
IP, but I know other folks are making this work without doing that.

If it makes a difference, the Proxmox host is in a data center, so
virtually all solutions that start with "Just point your browser to >
to complete setup," don't work for me.

----------------------------------------------------------------------
stefantigro · 2023-12-03 06:47

Is this for consumption by others or for personal use?

If you intend to use it personally consider not exposing it at all and
use a VPN. I recommend tailscale.

If you wish others to use them, then you probably don't want the
entire cluster to be exposed. What I do is run an nginx proxy manager
on one machine, I expose that only on Port 80 and 443 and I setup a
firewall in proxmox to only accept requests to it from cloudflare's
ips. Consequently I also have set it up that all connections to that
ip are proxied from cloudflare.

----------------------------------------------------------------------
Sky_Linx · 2023-12-03 10:36

Check out inlets

----------------------------------------------------------------------
stappersg · 2023-12-03 12:05

My websearch on _inlets_ yielded
https://inlets.dev/blog/2021/12/06/expose-traefik.html which has title
"Expose Traefik with K3s to the Internet".   (No, I have no experience
with it. (Would to read _works for me_ messages.))

----------------------------------------------------------------------
stappersg · 2023-12-03 12:13

And after reading _"You’ll also need a valid inlets subscription to
install the inlets-operator that we’ll use to expose your services. If
you just want to kick the tires, you can pay month-by-month with no
commitment."_, I knew that I should continue to explore [metal
lb](https://metallb.org/) further.

----------------------------------------------------------------------
elh0mbre · 2023-12-03 21:02

You shouldn't be routing requests to nodes.  You should have ingress
that routes to services.

----------------------------------------------------------------------
DougEubanks · 2023-12-03 22:51

CloudFlare tunnels!