<p>I'm trying to install a service mesh in my Kubernetes cluster, and for that I want to accomplish the following:</p>

<ul>
<li>The service mesh pods are run as a Daemon Set, with one replica on each node.</li>
<li>The service mesh is not directly reachable from outside the cluster.</li>
<li>The application pods use the service mesh pod <em>on the same node</em> as a http proxy for all requests.</li>
</ul>

<p>In order to do so, I've added the following configuration to the container spec on the application Deployment:</p>

<pre><code># deployment.spec.template.spec.containers[0]
  env:
  - name: NODE_NAME
    valueFrom:
      fieldRef:
        fieldPath: spec.nodeName
  - name: HTTP_PROXY
    value: http://$(NODE_NAME):4140
</code></pre>

<p>However, I'm failing to expose the service mesh properly; I've tried with both services of <code>type: ClusterIP</code> and <code>type: LoadBalancer</code>, but with the former I fail to connect, and with the latter I expose the service mesh publicly, which I don't want to do. I've also tried to get something working with <code>NodePort</code>, but I haven't even been able to figure out a valid configuration there yet (and there seems to be some opinion that <a href="https://oteemo.com/2017/12/12/think-nodeport-kubernetes/" rel="noreferrer">NodePort should be avoided if possible</a>...).</p>

<p>How should I expose the service mesh, preferrably on ports 4140-4142 and 9990, in a way that is reachable on a specific node (the current one) from other pods?</p>

<p>You could put your pods in the host network space. That way you won't need any Service and your Pod will be reachable on the port you declare in the <code>PodSpec</code> on every node.</p>

<p>You could avoid external reachability by binding your service to 127.0.0.1 rather than 0.0.0.0</p>

<p>If you want to give it a try, you can run a port in the host network space by adding the following to the PodSpec of your DaemonSet:</p>

<pre><code>hostNetwork: true
</code></pre>

<p>Please be aware that, with this solution, you'll need to use the host's IP address in order to connect to your pod.</p>

<p>In order to get internal DNS names resolution in your hostNetworked pods, you also need to set DNS policy like this:</p>

<pre><code>dnsPolicy: ClusterFirstWithHostNet
</code></pre>

<p>This will ensure your pods will use the internal DNS server for name resolution.</p>
