<p>I just configured a Kubernetes Cluster with this environment</p>
<p>4 VPS nodes with one public IP for each node</p>
<p>K3S Cluster with embebed etcd (k3s version v1.22.7+k3s1)</p>
<ul>
<li>3 master nodes</li>
<li>1 Worker node just for testing</li>
</ul>
<p>MetalLB for Internal Load Balancer (metallb/v0.12.1)</p>
<ul>
<li>IP Range 10.10.0.200-10.10.0.250</li>
</ul>
<p>Traefik as default Kubernetes Ingress Class (Chart v10.19.4 &amp; App v2.6.3)</p>
<p>Every thing is running as expected, I can access all services inside each node in the cluster.</p>
<p>Now, how to finally expose services to Internet Acesss?</p>
<ul>
<li>Cloud Provider Firewall already exposing ports 80 and 443</li>
<li>Internal iptables firewall accept public traffict from those ports</li>
</ul>
<p>I thought Traefik automatically expose port 80 and 443, but lsof actually is not showing as &quot;LISTEN&quot;. and pubic ips not responding anything. I am really confused at this, I am newby in kubernetes world.</p>
<p>I have tried port forwarding private ip to metallb load balancer ip but it actually not solve the route.</p>
<pre><code>iptables -t nat -I PREROUTING -p tcp -d &lt;enp0s3-local-ip&gt; --dport 80 -j DNAT --to-destination &lt;load-balancer-ip&gt;:80
iptables -I FORWARD -m state -d &lt;load-balancer-subnet&gt;/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT
</code></pre>
<p>Edit: <a href="https://i.postimg.cc/mD00Fk4L/Screen-Shot-2022-04-06-at-22-04-02.png" rel="nofollow noreferrer">The nodes and traefik already showing the public ip</a></p>
<p>But response from outside the cluster still <code>curl: (56) Recv failure: Connection reset by peer</code></p>

joepa37
<p>Try using the <code>kubectl</code> expose command:</p>
<pre><code>$ kubectl expose (-f FILENAME | TYPE NAME) [--port=port] [--protocol=TCP|UDP|SCTP] [--target-port=number-or-name] [--name=name] [--external-ip=external-ip-of-service] [--type=type]
</code></pre>
<blockquote>
<p>--external-ip=Additional external IP address (not managed by Kubernetes) to accept for the service. If this IP is routed to a node,
the service can be accessed by this IP in addition to its generated
service IP.</p>
</blockquote>
<p>Or when you install traefik add this value file (as traefik.yaml in this case):</p>
<pre><code>service:
  externalIPs:
    - &lt;your_external_static_ip_here_without_the_brackets&gt;
</code></pre>
<p>and then install it like this:</p>
<pre><code>helm install --values=./traefik.yaml traefik traefik/traefik -n traefik --create-namespace
</code></pre>
<p>Refer to the <a href="https://stackoverflow.com/questions/62559281/expose-kubernetes-cluster-to-internet">stackpost</a> and a document on <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/exposing-apps#:%7E:text=From%20the%20Service%20type%20drop,Kubernetes%20assigned%20to%20your%20Service." rel="nofollow noreferrer">Exposing applications using services</a> for more information.</p>
