<p>I have install a minikube on my linux-laptop (Computer A)</p>
<p><a href="https://i.stack.imgur.com/WdHb7.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/WdHb7.png" alt="enter image description here" /></a></p>
<p>and deploy some service on it :</p>
<pre><code>$ minikube service list</code></pre>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>NAMESPACE</th>
<th>NAME</th>
<th>TARGET PORT</th>
<th>URL</th>
</tr>
</thead>
<tbody>
<tr>
<td>cert-manager</td>
<td>cert-manager</td>
<td>No node port</td>
<td></td>
</tr>
<tr>
<td>cert-manager</td>
<td>cert-manager-webhook</td>
<td>No node port</td>
<td></td>
</tr>
<tr>
<td>default</td>
<td>aws</td>
<td>5000</td>
<td><a href="http://192.168.49.2:30728" rel="nofollow noreferrer">http://192.168.49.2:30728</a></td>
</tr>
<tr>
<td>default</td>
<td>azure</td>
<td>5000</td>
<td><a href="http://192.168.49.2:31794" rel="nofollow noreferrer">http://192.168.49.2:31794</a></td>
</tr>
<tr>
<td>default</td>
<td>gcloud</td>
<td>5000</td>
<td><a href="http://192.168.49.2:32367" rel="nofollow noreferrer">http://192.168.49.2:32367</a></td>
</tr>
<tr>
<td>default</td>
<td>hft</td>
<td>5000</td>
<td><a href="http://192.168.49.2:30970" rel="nofollow noreferrer">http://192.168.49.2:30970</a></td>
</tr>
<tr>
<td>default</td>
<td>hftf</td>
<td>5000</td>
<td><a href="http://192.168.49.2:30612" rel="nofollow noreferrer">http://192.168.49.2:30612</a></td>
</tr>
<tr>
<td>default</td>
<td>kubernetes</td>
<td>No node port</td>
<td></td>
</tr>
<tr>
<td>default</td>
<td>open</td>
<td>5000</td>
<td><a href="http://192.168.49.2:31547" rel="nofollow noreferrer">http://192.168.49.2:31547</a></td>
</tr>
<tr>
<td>ingress-nginx</td>
<td>ingress-nginx-controller</td>
<td>http/80</td>
<td><a href="http://192.168.49.2:31053" rel="nofollow noreferrer">http://192.168.49.2:31053</a></td>
</tr>
<tr>
<td></td>
<td></td>
<td>https/443</td>
<td><a href="http://192.168.49.2:30302" rel="nofollow noreferrer">http://192.168.49.2:30302</a></td>
</tr>
<tr>
<td>ingress-nginx</td>
<td>ingress-nginx-controller-admission</td>
<td>No node port</td>
<td></td>
</tr>
<tr>
<td>kube-system</td>
<td>kube-dns</td>
<td>No node port</td>
<td></td>
</tr>
<tr>
<td>kubernetes-dashboard</td>
<td>dashboard-metrics-scraper</td>
<td>No node port</td>
<td></td>
</tr>
<tr>
<td>kubernetes-dashboard</td>
<td>kubernetes-dashboard</td>
<td>No node port</td>
<td></td>
</tr>
</tbody>
</table>
</div>
<p>As you can see there is 6 service create with fastAPI and that are behind an ingress.
I have set my ingress with the host <code>galigator.fun</code>. Cert-manager is ready to fire, but for now TLS is comment in the ingress.
<code>galigator.fun</code> is DNS name I own.</p>
<pre><code>
$ minikube addons enable ingress
$ kubectl describe ingress
Name:             multiplex-applications
Namespace:        default
Address:          192.168.49.2
Default backend:  default-http-backend:80 ()
Rules:
  Host           Path  Backends
  ----           ----  --------
  galigator.fun  
                 /v1/aws/(.+)            aws:5000 (172.17.0.11:5000)
                 /v1/azure/(.+)          azure:5000 (172.17.0.14:5000)
                 /v1/gcloud/(.+)         gcloud:5000 (172.17.0.13:5000)
                 /v1/deepml/best/(.+)    hftf:5000 (172.17.0.10:5000)
                 /v1/deepml/edge/(.+)    hft:5000 (172.17.0.3:5000)
                 /v1/deepml/razor/(.+)   open:5000 (172.17.0.8:5000)
Annotations:     cert-manager.io/issue-temporary-certificate: true
                 cert-manager.io/issuer: letsencrypt-staging
                 kubernetes.io/ingress.class: nginx
                 nginx.ingress.kubernetes.io/rewrite-target: /$1
Events:
  Type    Reason  Age                From                      Message
  ----    ------  ----               ----                      -------
  Normal  Sync    52m (x3 over 53m)  nginx-ingress-controller  Scheduled for sync

</code></pre>
<p>The error from Default backend seem not related to my problem...</p>
<p>If add an entry to <code>/etc/hosts</code> with <code>minikube ip</code> and <code>galigator.fun</code> then I can run my services without problem.
But there are not available from Computer B not Computer C.</p>
<p><strong>How to access my services from Computer B and Computer C ?</strong></p>
<p><em>I don't want to change any configuration in computer B &amp; C.</em></p>
<p>As I understand, the <code>minikube ip</code> isn't know from my Internet Box; it is not a physical equipement.
My minikube run from my kubuntu-21.04 and is start with <code>minikube start --ports=80,443</code> or just <code>minikube start</code> but I can't observe a difference.</p>
<p>Another thing that don't look to work.</p>
<pre><code>
$ kubectl port-forward --address 0.0.0.0 deployment/ingress-nginx-controller 80:80 --namespace ingress-nginx
Unable to listen on port 80: Listeners failed to create with the following errors: [unable to create listener: Error listen tcp4 0.0.0.0:80: bind: permission denied]
error: unable to listen on any of the requested ports: [{80 80}]
</pre></code>
<p>I have properly test the connectivity between Internet and Computer A for port 80 &amp; 443 using an Apache. Since I have remove that server.</p>

<p>First as the doc explain I try to play with <code>minikube</code> startup options.</p>
<pre><code>minikube start --listen-address='0.0.0.0' --ports=80,443
</code></pre>
<p>But as we can see it doesn't change anything:</p>
<pre><code>$ docker container ls |grep minikube
0aafb00fd97d   gcr.io/k8s-minikube/kicbase:v0.0.25   &quot;/usr/local/bin/entr…&quot;   3 weeks ago    Up 22 minutes   127.0.0.1:49172-&gt;22/tcp, 127.0.0.1:49171-&gt;2376/tcp, 127.0.0.1:49170-&gt;5000/tcp, 127.0.0.1:49169-&gt;8443/tcp, 127.0.0.1:49168-&gt;32443/tcp   minikube
</code></pre>
<p>So if we investigate deeper on error of command :</p>
<pre><code>kubectl port-forward -n ingress-nginx  --address 0.0.0.0 service/ingress-nginx-controller 80:80 443:443
</code></pre>
<p>we can find that binding to port <code>80</code> and <code>443</code> but they are below <code>1000</code> and require extra privilege/root. And <code>kubectl</code> isn't a root process, for goods reasons.</p>
<p>So an ugly solution that work could be to do something like that :</p>
<pre><code>kubectl port-forward -n ingress-nginx  --address 0.0.0.0 service/ingress-nginx-controller 50000:80 50001:443
</code></pre>
<p>And then change the NAT rules in the InternetBox. But I don't like it because <code>minikube</code> is an implementation detail that should not impact another hardware.</p>
<p>So a less horrible solution is to give kubectl the write to bind to low number ports...</p>
<pre><code>$ man 7 capabilities | grep -A 1 CAP_NET_BIND_SERVICE
       CAP_NET_BIND_SERVICE
              Bind a socket to Internet domain privileged ports (port numbers less than 1024).
</code></pre>
<p>So command should be :</p>
<pre><code>sudo setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/kubectl
</code></pre>
<p>and then</p>
<pre><code>kubectl port-forward -n ingress-nginx  --address 0.0.0.0 service/ingress-nginx-controller 80:80 443:443
</code></pre>
<p>it works to...</p>
<p><strong>But there is one major concern here, we have to redo the last command on every startup, and the last two ones on every upgrade...</strong></p>
<p>If someone have a good answer, that could also work for a background server on a <code>LAN</code>, I would love it.</p>
<p>Port <code>80</code> is require only during the execution of the challenge from cert-manager. So a solution that could get close it, could also be interesting.</p>
