<p>I've installed kong-ingress-controller using yaml file on a 3-nodes k8s cluster( bare metal ) (you can see the file at the bottom of question) and every thing is up and runnig:</p>
<pre><code>$kubectl get pods --all-namespaces
NAMESPACE     NAME                                        READY   STATUS    RESTARTS   AGE
default       bar-deployment-64d5b5b5c4-99p4q             1/1     Running   0          12m
default       foo-deployment-877bf9974-xmpj6              1/1     Running   0          15m
kong          ingress-kong-5cd9db4db9-4cg4q               2/2     Running   0          79m
kube-system   calico-kube-controllers-5f6cfd688c-5njnn    1/1     Running   0          18h
kube-system   calico-node-5k9b6                           1/1     Running   0          18h
kube-system   calico-node-jbb7k                           1/1     Running   0          18h
kube-system   calico-node-mmmts                           1/1     Running   0          18h
kube-system   coredns-74ff55c5b-5q5fn                     1/1     Running   0          23h
kube-system   coredns-74ff55c5b-9bbbk                     1/1     Running   0          23h
kube-system   etcd-kubernetes-master                      1/1     Running   1          23h
kube-system   kube-apiserver-kubernetes-master            1/1     Running   1          23h
kube-system   kube-controller-manager-kubernetes-master   1/1     Running   1          23h
kube-system   kube-proxy-4h7hs                            1/1     Running   0          20h
kube-system   kube-proxy-sd6b2                            1/1     Running   0          20h
kube-system   kube-proxy-v9z8p                            1/1     Running   1          23h
kube-system   kube-scheduler-kubernetes-master            1/1     Running   1          23h
</code></pre>
<p><strong>but the problem is here</strong>:</p>
<p>the <strong><code>EXTERNAL_IP</code></strong> of <strong><code>kong-proxy service</code></strong> is <strong>pending</strong> so i'm not able to reach to my cluster from the outside</p>
<pre><code>$kubectl get services --all-namespaces
NAMESPACE     NAME                      TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
default       bar-service               ClusterIP      10.103.49.102   &lt;none&gt;        5000/TCP                     15m
default       foo-service               ClusterIP      10.102.52.89    &lt;none&gt;        5000/TCP                     19m
default       kubernetes                ClusterIP      10.96.0.1       &lt;none&gt;        443/TCP                      23h
kong          kong-proxy                LoadBalancer   10.104.79.161   &lt;pending&gt;     80:31583/TCP,443:30053/TCP   82m
kong          kong-validation-webhook   ClusterIP      10.109.75.104   &lt;none&gt;        443/TCP                      82m
kube-system   kube-dns                  ClusterIP      10.96.0.10      &lt;none&gt;        53/UDP,53/TCP,9153/TCP       23h

</code></pre>
<pre><code>$ kubectl describe service kong-proxy -n kong

Name:                     kong-proxy
Namespace:                kong
Labels:                   &lt;none&gt;
Annotations:              service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
                          service.beta.kubernetes.io/aws-load-balancer-type: nlb
Selector:                 app=ingress-kong
Type:                     LoadBalancer
IP Families:              &lt;none&gt;
IP:                       10.104.79.161
IPs:                      10.104.79.161
Port:                     proxy  80/TCP
TargetPort:               8000/TCP
NodePort:                 proxy  31583/TCP
Endpoints:                192.168.74.69:8000
Port:                     proxy-ssl  443/TCP
TargetPort:               8443/TCP
NodePort:                 proxy-ssl  30053/TCP
Endpoints:                192.168.74.69:8443
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   &lt;none&gt;

</code></pre>
<p>my k8s version is 1.20.1 and
my docker version is 19.3.10 .
If someone could help me to get a solution ,that would be awesome</p>
<p>=============================================</p>
<p><strong>kong-ingress-controller</strong> yaml file:</p>
<pre><code>apiVersion: v1
kind: Namespace
metadata:
  name: kong
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: kongclusterplugins.configuration.konghq.com
spec:
  additionalPrinterColumns:
  - JSONPath: .plugin
    description: Name of the plugin
    name: Plugin-Type
    type: string
  - JSONPath: .metadata.creationTimestamp
    description: Age
    name: Age
    type: date
  - JSONPath: .disabled
    description: Indicates if the plugin is disabled
    name: Disabled
    priority: 1
    type: boolean
  - JSONPath: .config
    description: Configuration of the plugin
    name: Config
    priority: 1
    type: string
  group: configuration.konghq.com
  names:
    kind: KongClusterPlugin
    plural: kongclusterplugins
    shortNames:
    - kcp
  scope: Cluster
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        config:
          type: object
        configFrom:
          properties:
            secretKeyRef:
              properties:
                key:
                  type: string
                name:
                  type: string
                namespace:
                  type: string
              required:
              - name
              - namespace
              - key
              type: object
          type: object
        disabled:
          type: boolean
        plugin:
          type: string
        protocols:
          items:
            enum:
            - http
            - https
            - grpc
            - grpcs
            - tcp
            - tls
            type: string
          type: array
        run_on:
          enum:
          - first
          - second
          - all
          type: string
      required:
      - plugin
  version: v1
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: kongconsumers.configuration.konghq.com
spec:
  additionalPrinterColumns:
  - JSONPath: .username
    description: Username of a Kong Consumer
    name: Username
    type: string
  - JSONPath: .metadata.creationTimestamp
    description: Age
    name: Age
    type: date
  group: configuration.konghq.com
  names:
    kind: KongConsumer
    plural: kongconsumers
    shortNames:
    - kc
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        credentials:
          items:
            type: string
          type: array
        custom_id:
          type: string
        username:
          type: string
  version: v1
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: kongingresses.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    kind: KongIngress
    plural: kongingresses
    shortNames:
    - ki
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        proxy:
          properties:
            connect_timeout:
              minimum: 0
              type: integer
            path:
              pattern: ^/.*$
              type: string
            protocol:
              enum:
              - http
              - https
              - grpc
              - grpcs
              - tcp
              - tls
              type: string
            read_timeout:
              minimum: 0
              type: integer
            retries:
              minimum: 0
              type: integer
            write_timeout:
              minimum: 0
              type: integer
          type: object
        route:
          properties:
            headers:
              additionalProperties:
                items:
                  type: string
                type: array
              type: object
            https_redirect_status_code:
              type: integer
            methods:
              items:
                type: string
              type: array
            path_handling:
              enum:
              - v0
              - v1
              type: string
            preserve_host:
              type: boolean
            protocols:
              items:
                enum:
                - http
                - https
                - grpc
                - grpcs
                - tcp
                - tls
                type: string
              type: array
            regex_priority:
              type: integer
            request_buffering:
              type: boolean
            response_buffering:
              type: boolean
            snis:
              items:
                type: string
              type: array
            strip_path:
              type: boolean
        upstream:
          properties:
            algorithm:
              enum:
              - round-robin
              - consistent-hashing
              - least-connections
              type: string
            hash_fallback:
              type: string
            hash_fallback_header:
              type: string
            hash_on:
              type: string
            hash_on_cookie:
              type: string
            hash_on_cookie_path:
              type: string
            hash_on_header:
              type: string
            healthchecks:
              properties:
                active:
                  properties:
                    concurrency:
                      minimum: 1
                      type: integer
                    healthy:
                      properties:
                        http_statuses:
                          items:
                            type: integer
                          type: array
                        interval:
                          minimum: 0
                          type: integer
                        successes:
                          minimum: 0
                          type: integer
                      type: object
                    http_path:
                      pattern: ^/.*$
                      type: string
                    timeout:
                      minimum: 0
                      type: integer
                    unhealthy:
                      properties:
                        http_failures:
                          minimum: 0
                          type: integer
                        http_statuses:
                          items:
                            type: integer
                          type: array
                        interval:
                          minimum: 0
                          type: integer
                        tcp_failures:
                          minimum: 0
                          type: integer
                        timeout:
                          minimum: 0
                          type: integer
                      type: object
                  type: object
                passive:
                  properties:
                    healthy:
                      properties:
                        http_statuses:
                          items:
                            type: integer
                          type: array
                        interval:
                          minimum: 0
                          type: integer
                        successes:
                          minimum: 0
                          type: integer
                      type: object
                    unhealthy:
                      properties:
                        http_failures:
                          minimum: 0
                          type: integer
                        http_statuses:
                          items:
                            type: integer
                          type: array
                        interval:
                          minimum: 0
                          type: integer
                        tcp_failures:
                          minimum: 0
                          type: integer
                        timeout:
                          minimum: 0
                          type: integer
                      type: object
                  type: object
                threshold:
                  type: integer
              type: object
            host_header:
              type: string
            slots:
              minimum: 10
              type: integer
          type: object
  version: v1
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: kongplugins.configuration.konghq.com
spec:
  additionalPrinterColumns:
  - JSONPath: .plugin
    description: Name of the plugin
    name: Plugin-Type
    type: string
  - JSONPath: .metadata.creationTimestamp
    description: Age
    name: Age
    type: date
  - JSONPath: .disabled
    description: Indicates if the plugin is disabled
    name: Disabled
    priority: 1
    type: boolean
  - JSONPath: .config
    description: Configuration of the plugin
    name: Config
    priority: 1
    type: string
  group: configuration.konghq.com
  names:
    kind: KongPlugin
    plural: kongplugins
    shortNames:
    - kp
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        config:
          type: object
        configFrom:
          properties:
            secretKeyRef:
              properties:
                key:
                  type: string
                name:
                  type: string
              required:
              - name
              - key
              type: object
          type: object
        disabled:
          type: boolean
        plugin:
          type: string
        protocols:
          items:
            enum:
            - http
            - https
            - grpc
            - grpcs
            - tcp
            - tls
            type: string
          type: array
        run_on:
          enum:
          - first
          - second
          - all
          type: string
      required:
      - plugin
  version: v1
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: tcpingresses.configuration.konghq.com
spec:
  additionalPrinterColumns:
  - JSONPath: .status.loadBalancer.ingress[*].ip
    description: Address of the load balancer
    name: Address
    type: string
  - JSONPath: .metadata.creationTimestamp
    description: Age
    name: Age
    type: date
  group: configuration.konghq.com
  names:
    kind: TCPIngress
    plural: tcpingresses
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        apiVersion:
          type: string
        kind:
          type: string
        metadata:
          type: object
        spec:
          properties:
            rules:
              items:
                properties:
                  backend:
                    properties:
                      serviceName:
                        type: string
                      servicePort:
                        format: int32
                        type: integer
                    type: object
                  host:
                    type: string
                  port:
                    format: int32
                    type: integer
                type: object
              type: array
            tls:
              items:
                properties:
                  hosts:
                    items:
                      type: string
                    type: array
                  secretName:
                    type: string
                type: object
              type: array
          type: object
        status:
          type: object
  version: v1beta1
status:
  acceptedNames:
    kind: &quot;&quot;
    plural: &quot;&quot;
  conditions: []
  storedVersions: []
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kong-serviceaccount
  namespace: kong
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: kong-ingress-clusterrole
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - endpoints
  - nodes
  - pods
  - secrets
  verbs:
  - list
  - watch
- apiGroups:
  - &quot;&quot;
  resources:
  - nodes
  verbs:
  - get
- apiGroups:
  - &quot;&quot;
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  - extensions
  - networking.internal.knative.dev
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - &quot;&quot;
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - networking.k8s.io
  - extensions
  - networking.internal.knative.dev
  resources:
  - ingresses/status
  verbs:
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - tcpingresses/status
  verbs:
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongplugins
  - kongclusterplugins
  - kongcredentials
  - kongconsumers
  - kongingresses
  - tcpingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - &quot;&quot;
  resources:
  - configmaps
  verbs:
  - create
  - get
  - update
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kong-ingress-clusterrole-nisa-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kong-ingress-clusterrole
subjects:
- kind: ServiceAccount
  name: kong-serviceaccount
  namespace: kong
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
  name: kong-proxy
  namespace: kong
spec:
  ports:
  - name: proxy
    port: 80
    protocol: TCP
    targetPort: 8000
  - name: proxy-ssl
    port: 443
    protocol: TCP
    targetPort: 8443
  selector:
    app: ingress-kong
  type: LoadBalancer
---
apiVersion: v1
kind: Service
metadata:
  name: kong-validation-webhook
  namespace: kong
spec:
  ports:
  - name: webhook
    port: 443
    protocol: TCP
    targetPort: 8080
  selector:
    app: ingress-kong
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: ingress-kong
  name: ingress-kong
  namespace: kong
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ingress-kong
  template:
    metadata:
      annotations:
        kuma.io/gateway: enabled
        prometheus.io/port: &quot;8100&quot;
        prometheus.io/scrape: &quot;true&quot;
        traffic.sidecar.istio.io/includeInboundPorts: &quot;&quot;
      labels:
        app: ingress-kong
    spec:
      containers:
      - env:
        - name: KONG_PROXY_LISTEN
          value: 0.0.0.0:8000, 0.0.0.0:8443 ssl http2
        - name: KONG_PORT_MAPS
          value: 80:8000, 443:8443
        - name: KONG_ADMIN_LISTEN
          value: 127.0.0.1:8444 ssl
        - name: KONG_STATUS_LISTEN
          value: 0.0.0.0:8100
        - name: KONG_DATABASE
          value: &quot;off&quot;
        - name: KONG_NGINX_WORKER_PROCESSES
          value: &quot;2&quot;
        - name: KONG_ADMIN_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_ADMIN_ERROR_LOG
          value: /dev/stderr
        - name: KONG_PROXY_ERROR_LOG
          value: /dev/stderr
        image: kong:2.5
        lifecycle:
          preStop:
            exec:
              command:
              - /bin/sh
              - -c
              - kong quit
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /status
            port: 8100
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: proxy
        ports:
        - containerPort: 8000
          name: proxy
          protocol: TCP
        - containerPort: 8443
          name: proxy-ssl
          protocol: TCP
        - containerPort: 8100
          name: metrics
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /status
            port: 8100
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
      - env:
        - name: CONTROLLER_KONG_ADMIN_URL
          value: https://127.0.0.1:8444
        - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
          value: &quot;true&quot;
        - name: CONTROLLER_PUBLISH_SERVICE
          value: kong/kong-proxy
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        image: kong/kubernetes-ingress-controller:1.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: ingress-controller
        ports:
        - containerPort: 8080
          name: webhook
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
      serviceAccountName: kong-serviceaccount

</code></pre>

<p>the short answer is what @iglen_ said <a href="https://stackoverflow.com/a/69177863/12741668">in this answer</a> but I decided to explain the solution.</p>
<p>When using a cloud provider the <code>LoadBalancer</code> type for Services will be managed and provisioned by the environment (see <a href="https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#external-load-balancer-providers" rel="nofollow noreferrer">k8s docs</a>) automatically, but when creating your own baremetal cluster you will need to add the service which will manage provisioning <code>IPs</code> for <code>LoadBalancer</code> type Services. One such service is <a href="https://metallb.universe.tf" rel="nofollow noreferrer">Metal-LB</a> which is built for this.</p>
<p>Before installation MetalLB Check the <a href="https://metallb.universe.tf/#requirements" rel="nofollow noreferrer">requirements</a>.</p>
<p>before we deploying MetalLB we need to do one step:</p>
<blockquote>
<p>If you’re using kube-proxy in IPVS mode, since Kubernetes v1.14.2 you
have to enable strict ARP mode.</p>
</blockquote>
<p>Note, you don’t need this if you’re using kube-router as service-proxy because it is enabling strict ARP by default.
enter this command:</p>
<p><code>$ kubectl edit configmap -n kube-system kube-proxy</code></p>
<p>in the opened up page search for <strong>mode</strong>, in my case the mode is equal to empty string so i don't need to change any thing but in the case that mode is set to <code>ipvs</code> as it said in the installation guide you need to set below configuration in this file:</p>
<pre><code>apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: &quot;ipvs&quot;
ipvs:
  strictARP: true
</code></pre>
<p>as the next step you need to run these commands:</p>
<pre><code>$ kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.10.2/manifests/namespace.yaml
$ kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.10.2/manifests/metallb.yaml
$ kubectl create secret generic -n metallb-system memberlist --from-literal=secretkey=&quot;$(openssl rand -base64 128)&quot;
</code></pre>
<p>after running above commands we have this:</p>
<pre><code>$ kubectl get all -n metallb-system
NAME                              READY   STATUS    RESTARTS   AGE
pod/controller-6b78sff7d9-2rv2f   1/1     Running   0          3m
pod/speaker-7bqev                 1/1     Running   0          3m
pod/speaker-txrg5                 1/1     Running   0          3m
pod/speaker-w7th5                 1/1     Running   0          3m

NAME                     DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR            AGE
daemonset.apps/speaker   3         3         3       3            3           kubernetes.io/os=linux   3m

NAME                         READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/controller   1/1     1            1           3m

NAME                                    DESIRED   CURRENT   READY   AGE
replicaset.apps/controller-6b78sff7d9   1         1         1       3m

</code></pre>
<p>MetalLB needs some <code>IPv4 addresses</code> :</p>
<pre><code>$ ip a s
1: ens160: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc mq state UP group default qlen 1000
   [...]
    inet 10.240.1.59/24 brd 10.240.1.255 scope global dynamic noprefixroute ens160
       valid_lft 425669sec preferred_lft 421269sec
    [...]
</code></pre>
<p>the <code>ens160</code> is my control-plane network interface and as you see its ip range is <code>10.240.1.59/24</code> so i'm going to assign a set of ip address in this network:</p>
<pre><code>$ sipcalc 10.240.1.59/24
-[ipv4 : 10.240.1.59/24] - 0

[CIDR]
Host address            - 10.240.1.59
Host address (decimal)  - 183500115
Host address (hex)      - AF0031B
Network address         - 10.240.1.0
Network mask            - 255.255.255.0
Network mask (bits)     - 24
Network mask (hex)      - FFFFF000
Broadcast address       - 10.240.1.255
Cisco wildcard          - 0.0.0.255
Addresses in network    - 256
Network range           - 10.240.1.0 - 10.240.1.255
Usable range            - 10.240.1.1 - 10.240.1.254

</code></pre>
<p>now i'm going to take <strong>10</strong> ip addresses from the <code>Usable range</code> and assign it to MetalLB.
let's create a <code>configmap</code> for MetalLB :</p>
<pre><code>$ sudo nano metallb-cm.yaml
</code></pre>
<p>paste the below configuration into metallb-cm.yaml:</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  namespace: metallb-system
  name: config
data:
  config: |
    address-pools:
    - name: default
      protocol: layer2
      addresses:
      - 10.240.1.100-10.240.1.110
</code></pre>
<p>then save the file and run this command:</p>
<pre><code>$ kubectl create -f metallb-cm.yaml
</code></pre>
<p>now let's check our services again:</p>
<pre><code>$ kubectl get services --all-namespaces
NAMESPACE     NAME                      TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
default       bar-service               ClusterIP      10.103.49.102   &lt;none&gt;        5000/TCP                     15m
default       foo-service               ClusterIP      10.102.52.89    &lt;none&gt;        5000/TCP                     19m
default       kubernetes                ClusterIP      10.96.0.1       &lt;none&gt;        443/TCP                      23h
kong          kong-proxy                LoadBalancer   10.104.79.161   10.240.1.100  80:31583/TCP,443:30053/TCP   82m
kong          kong-validation-webhook   ClusterIP      10.109.75.104   &lt;none&gt;        443/TCP                      82m
kube-system   kube-dns                  ClusterIP      10.96.0.10      &lt;none&gt;        53/UDP,53/TCP,9153/TCP       23h

</code></pre>
<p>as you can see the service of type <code>LoadBalancer</code> has an ip address now.</p>
