具有 MatalLB 和 Ingress 的裸机集群上的真实 IP（域和子域）

Question

help me figure it out.

I have a Bare Metal Kubernetes cluster with three nodes, each node has a public ip. I have installed MetalLB and IngressController.

It is not clear to me which IP should I redirect domains and subdomains to so that they can be resolved by the Ingress Controller?

I need to initially define on which node the Ingress Controller will be launched? I need to install the Ingress Controller, and then look at the worker node, on which it will be installed and send all domains or subdomains there? What happens if, after restarting the cluster, the ingress controller will be deployed on another node?

All the tutorials I've seen show how it works locally or with a cloud load balancer.

Help me understand how this should work correctly.

Answer 1

Usually, when you install MetalLB, you configure a pool of addresses which can be used to assign new IPs at LoadBalancer services whenever they are created. Such IP addresses need to be available, they cannot be created out of nothing of course.. they could be in lease from your hosting provider for example.

If instead you have a private Bare Metal cluster which serves only your LAN network, you could just select a private range of IP addresses which are not used.

Then, once MetalLB is running, what happens is the following:

• Someone / something creates a LoadBalancer services (an HELM Chart, a user with a definition, with commands, etc)
• The newly created service needs an external IP. MetalLB will select one address from the configured selected range and assign it to that service
• MetalLb will start to announce using standard protocol that the IP address can now be reached by contacting the cluster, it can work either in Layer2 mode (one node of the cluster holds that additional IP address) or BGP (true load balancing across all nodes of the cluster)

From that point, you can just reach the new service by contacting this newly assigned IP address (which is NOT the ip of any of the cluster nodes)

Usually, the Ingress Controller will just bring a LoadBalancer service (which will grab an external IP address from MetalLb) and then, you can reach hte Ingress Controller from that IP.

As for your other questions, you don't need to worry about where the Ingress Controller is running or similar, it will be automatically handled.

The only thing you may want to do is to make the domain names which you want to serve point to the external IP address assigned to the Ingress Controller.

---

Some docs:

• MetalLB explanations
• Bitnami MetalLB chart
• LoadBalancer service docs

Answer 2

As an alternative (especially when you want "static" ip addresses) I should mention HAProxy, installed external to kubernetes cluster in a bare_server/vm/lxc_container/etc. and configured to send all incoming 80/433 traffic to the NodePort of ingress controller on all kubernetes workers (if no ingress pod is running on that worker traffic will be forwarded by kubernetes).

Of course, nowadays ip addresses are also "cattle", not "pets" anymore, so MetalLB is more of a "kubernetish" solution, but who knows...

This is the link describing HAProxy solution (I am not affiliated with the author):

https://itnext.io/bare-metal-kubernetes-with-kubeadm-nginx-ingress-controller-and-haproxy-bb0a7ef29d4e