<p>I am attempting to use <a href="https://knative.dev" rel="nofollow noreferrer">knative</a> to self-host a simple FaaS platform from an on-premises Linux server.  I have installed <a href="https://minikube.sigs.k8s.io/docs/start/" rel="nofollow noreferrer">minikube</a> successfully, and installed/configured knative using the <a href="https://knative.dev/docs/install/operator/knative-with-operators/" rel="nofollow noreferrer">knative operator</a>.</p>
<p>Following the default selection in the linked guide, I have set up <strong>kourier</strong> as the networking layer and selected <strong>Magic DNS</strong> (sslip.io) setup.  After running <code>minikube tunnel</code>, I can successfully serve demo apps like <a href="https://github.com/knative/docs/tree/main/code-samples/serving/hello-world/helloworld-python" rel="nofollow noreferrer">helloworld-python</a>.</p>
<p>However, my &quot;External IP&quot; according to KNative is a private-ip:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl --namespace knative-serving get service kourier

NAME      TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                      AGE
kourier   LoadBalancer   10.100.195.53   10.100.195.53   80:31140/TCP,443:31175/TCP   15h

</code></pre>
<p>(Note the IP starts with <code>10.</code>, this IP is not external to the machine.)</p>
<p>As such, the apps return sslip.io addresses containing this private IP: <code>http://helloworld-python.default.10.100.195.53.sslip.io</code>. As a result, I can query this service (e.g. via <code>curl</code>) just fine from the host server, but I can't access the service from any other machine.  Likewise, if I attempt to configure any &quot;Eventing&quot; services, KNative produces webhooks with a private IP address, which obviously don't work since external services like GitHub don't resolve them.</p>
<p>So, <em>why does Knative</em> return a private IP in this setting?  The KNative installation doesn't seem to give any indication that this will be the case, suggesting that</p>
<pre><code>kubectl --namespace knative-serving get service kourier
</code></pre>
<p>might return a CNAME or an IP address and that we should &quot;note this for DNS configuration later&quot; (except if using Magic DNS).  Should it be returning a private IP?</p>
<ul>
<li><p>If so, what is the procedure for exposing services? Do I need to run some additional configuration to expose a public IP?</p>
</li>
<li><p>If not, is some additional per-configuration needed so that it uses the machine's public IP?  (or at least an IP I can bind my own reverse proxy to?)</p>
</li>
<li><p>Is <em>Kourier</em> designed to only do private IPs?  (The docs are pretty terse about why one should chose <em>kourier</em> vs <em>istio</em> or <em>contour</em> for networking, merely saying that <em>istio</em> is the default but new users should chose <em>kourier</em> if they are unsure??)</p>
</li>
</ul>
<p>As a side-note/ background context, my server has a fixed IP address, I use <a href="https://caddyserver.com/" rel="nofollow noreferrer">caddy</a> (in container on the same docker network as minikube) to provide https domain names to services.  Also, outside of knative, if I just follow standard <a href="https://minikube.sigs.k8s.io/docs/handbook/accessing/" rel="nofollow noreferrer">minikube guide</a> to make a service as NodePort or LoadBalancer, I can easily take the port that <code>kubectl get svc</code> shows, and expose the service in caddy by pointing to said port on the minikube container, something like this in the Caddyfile:</p>
<pre><code>minikube.app.mydomain.com {
  reverse_proxy minikube:32637 {
    header_up Host {host}
  } 
}
</code></pre>
<p>This is just to confirm that in vanilla minikube I have no trouble with ingress configuration.  KNative clearly has this extra layer of networking by which it's generating URLs for applications though and that has be flummoxed.  I can't just replace the `minikube:32637 with the private IP addresses KNative returns)</p>

cboettig
<p>Knative uses the HTTP <code>Host</code> header to share a single IP address across many services (sorta like what you're doing with caddy...).</p>
<p>If you want to use caddy to route these requests, you'll need to rewrite the <code>Host</code> header using <a href="https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#headers" rel="nofollow noreferrer">the <code>header_up</code> directive</a>. You may be able to use the replacement form and/or change the Knative domain prefix to make this easier.</p>
