<p>Currently practicing with Kubernetes (managed, on DO), I ran into a issue I couldn't resolve for two days. I have nginx-ingress setup along with cert-manager, and a domain where git.domain.com points to the IP of the load balancer. I can reach my Gitea deployment via the web, everything seems to work.</p>

<p>What I want to achieve now is, that I can also use SSH like so</p>

<pre><code>git clone git@git.domain.com:org/repo.git
</code></pre>

<p>So I somehow need to expose the container port 22 via the service, then via the ingress. I tried a couple of things, but none of them seemed to work, probably because I'm a starter at K8S. Here is the working setup I use.</p>

<p>Service definition:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: gitea-service
spec:
  selector:
    app: gitea
  ports:
  - name: gitea-http
    port: 3000
    targetPort: gitea-http
  - name: gitea-ssh
    port: 22
    targetPort: gitea-ssh
</code></pre>

<p>Ingress definiton</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: echo-ingress
  annotations:  
    kubernetes.io/ingress.class: nginx
    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
  - hosts:
    - git.domain.com
    secretName: letsencrypt-prod
  rules:
  - host: git.domain.com
    http:
      paths:
      - backend:
          serviceName: gitea-service
          servicePort: gitea-http
</code></pre>

<p>And part of my deployment, just to make sure:</p>

<pre><code>...
ports:
        - containerPort: 3000
          name: gitea-http
        - containerPort: 22
          name: gitea-ssh
...
</code></pre>

<p>Sorry if it's a dumb question, I think there is some basics that I confuse here. Thanks!</p>

<blockquote>
  <p>So I somehow need to expose the container port 22 via the service, then via the ingress</p>
</blockquote>

<p>So yes and no: an Ingress is specifically for virtual-hosting using the <code>host:</code> header (or SNI) of the incoming request to know which backend to use. There is no such mechanism in SSH, or at the very least there's no Ingress controller that I'm aware of which supports protocols other than http for doing that.</p>

<p>However, the <a href="https://kubernetes.github.io/ingress-nginx/" rel="noreferrer">nginx Ingress controller</a> supports <a href="https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/" rel="noreferrer">TCP and UDP services</a> so long as you can assign a dedicated port for them (which in your case, you can). You would create a <code>ConfigMap</code> entry saying which port on the <strong>ingress controller's</strong> <code>Service</code> to map to the port on <strong>gitea's</strong> <code>Service</code>, and then you'll need to expose port 22 on whatever is Internet-facing in Digital Ocean that routes traffic to the ingress controller's <code>Service</code>.</p>

<pre><code>[Internet] -&gt; :22[load balancer] --&gt; :12345[controller Service] --&gt; :22[gitea-service]
</code></pre>

<p>There are <a href="https://github.com/digitalocean/digitalocean-cloud-controller-manager/blob/master/docs/controllers/services/annotations.md#servicebetakubernetesiodo-loadbalancer-protocol" rel="noreferrer">Digital Ocean annotations</a> that you can use to switch certain ports over to TCP, but I didn't study that further than a quick search</p>

<p>I just used the nginx ingress controller as a concrete example, but the haproxy based ingress controllers will almost certainly do that, and other controllers may have similar options, because your question is a reasonable one</p>
