Ingress controllers usually use the standard k8s services. In fact metal-lb allows workloads (like the nginx ingress controller) in the cluster to use services of type LoadBalancer, which is the default configuration. This results in an actual IP being made available to your ingress controller.
- 0 Posts
- 3 Comments
Joined 1 year ago
Cake day: January 13th, 2024
You are not logged in. If you use a Fediverse account that is able to follow users, you can follow this user.
To get nginx ingress to use the external clients IP, you can configure the ingress controllers traffic policy. Using the helm chart, I used these values:
controller: service: # this has a bunch of downsides, but allows source-ip based access white/deny listing. externalTrafficPolicy: Local
For the ingress IP, I configured metal-lb to receive traffic on a static IP (using IP4AddressPool and L2Advertisement CRDs from metal-lb), which is then used for the port forwarding. I’ve never tested it because I only have a single worker node, but I expect the metal-lb controller will continue receiving traffic to that same static IP if a node goes down.
Another point to keep in mind - many distros now ship Podman instead of Docker, with Fedora being at the forefront of that change. If you‘re currently running Docker, you might want to check if your setup is drop-in compatible with Podman as some images will not work (usually related to permission or user switching, privileged ports).