<h1>I can't apply an ingress configuration.</h1>
<h3>I need access a jupyter-lab service by it's DNS</h3>
<ul>
<li><a href="http://jupyter-lab.local" rel="nofollow noreferrer">http://jupyter-lab.local</a></li>
</ul>
<p>It's deployed to a 3 node bare metal k8s cluster</p>
<ul>
<li>node1.local (master)</li>
<li>node2.local (worker)</li>
<li>node3.local (worker)</li>
</ul>
<p>Flannel is installed as the Network controller</p>
<h3>I've installed nginx ingress for bare metal like this</h3>
<ul>
<li><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.44.0/deploy/static/provider/baremetal/deploy.yaml</code></li>
</ul>
<p>When deployed the jupyter-lab pod is on node2 and the <em>NodePort</em> service responds correctly from <a href="http://node2.local:30004" rel="nofollow noreferrer">http://node2.local:30004</a> (see below)</p>
<h2>I'm expecting that the ingress-nginx controller will expose the <em>ClusterIP</em> service by its DNS name ...... thats what I need, is that wrong?</h2>
<p>This is the CIP service, defined with symmetrical ports <code>8888</code> to be as simple as possible (is that wrong?)</p>
<pre><code>---
apiVersion: v1
kind: Service
metadata:
  name: jupyter-lab-cip
  namespace: default
spec:
  type: ClusterIP
  ports:
    - port: 8888
      targetPort: 8888
  selector:
    app: jupyter-lab
</code></pre>
<ul>
<li><p>The DNS name <code>jupyter-lab.local</code> resolves to the ip address range of the cluster, but times out with no response. <code>Failed to connect to jupyter-lab.local port 80: No route to host</code></p>
</li>
<li><p><code>firewall-cmd --list-all</code> shows that port 80 is open on each node</p>
</li>
</ul>
<p>This is the ingress definition for http into the cluster (any node) on port 80.  (is that wrong ?)</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jupyter-lab-ingress
  annotations:
    # nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io: /
spec:
  rules:
  - host: jupyter-lab.local
    http:                       
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: jupyter-lab-cip
            port:
              number: 80
</code></pre>
<p>This the deployment</p>
<pre><code>---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jupyter-lab-dpt
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jupyter-lab
  template:
    metadata:
      labels:
        app: jupyter-lab
    spec:
      volumes:
        - name: jupyter-lab-home
          persistentVolumeClaim:
            claimName: jupyter-lab-pvc
      containers:
        - name: jupyter-lab
          image: docker.io/jupyter/tensorflow-notebook
          ports:
            - containerPort: 8888
          volumeMounts:
            - name: jupyter-lab-home
              mountPath: /var/jupyter-lab_home
          env:
            - name: &quot;JUPYTER_ENABLE_LAB&quot;
              value: &quot;yes&quot;
</code></pre>
<p>I can successfully access jupyter-lab by its NodePort http://node2:30004 with this definition:</p>
<pre><code>---
apiVersion: v1
kind: Service
metadata:
  name: jupyter-lab-nodeport
  namespace: default
spec:
  type: NodePort
  ports:
    - port: 10003
      targetPort: 8888
      nodePort: 30004
  selector:
    app: jupyter-lab
</code></pre>
<p>How can I get ingress to my jupyter-lab at <a href="http://jupyter-lab.local" rel="nofollow noreferrer">http://jupyter-lab.local</a>  ???</p>
<ul>
<li>the command <code>kubectl get endpoints -n ingress-nginx ingress-nginx-controller-admission</code> returns :</li>
</ul>
<p><code>ingress-nginx-controller-admission   10.244.2.4:8443   15m</code></p>
<hr />
<h2>Am I misconfiguring ports ?</h2>
<h2>Are my &quot;selector:appname&quot; definitions wrong ?</h2>
<h2>Am I missing a part</h2>
<h2>How can I debug what's going on ?</h2>
<hr />
<p>Other details</p>
<ul>
<li><p>I was getting this error when applying an ingress <code>kubectl apply -f default-ingress.yml</code></p>
<pre><code>Error from server (InternalError): error when creating &quot;minnimal-ingress.yml&quot;: Internal error occurred: failed calling webhook &quot;validate.nginx.ingress.kubernetes.io&quot;: Post &quot;https://ingress-nginx-contr
oller-admission.ingress-nginx.svc:443/networking/v1beta1/ingresses?timeout=10s&quot;: context deadline exceeded
</code></pre>
<p>This command <code>kubectl delete validatingwebhookconfigurations --all-namespaces</code>
removed the validating webhook ... was that wrong to do?</p>
</li>
<li><p>I've opened port 8443 on each node in the cluster</p>
</li>
</ul>

Kickaha
<p>Ingress is invalid, try the following:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jupyter-lab-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: jupyter-lab.local
    http:                       # &lt;- removed the -
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
#            name: jupyter-lab-cip
            name: jupyter-lab-nodeport
            port:
              number: 8888
---
apiVersion: v1
kind: Service
metadata:
  name: jupyter-lab-cip
  namespace: default
spec:
  type: ClusterIP
  ports:
    - port: 8888
      targetPort: 8888
  selector:
    app: jupyter-lab
</code></pre>
<hr />
<p>If I understand correctly, you are trying to expose jupyternb through ingress nginx proxy and to make it accessible through port 80.</p>
<p>Run the folllowing command to check what nodeport is used by nginx ingress service:</p>
<pre><code>$ kubectl get svc -n ingress-nginx ingress-nginx-controller
NAME                       TYPE       CLUSTER-IP     EXTERNAL-IP   PORT(S)                      AGE
ingress-nginx-controller   NodePort   10.96.240.73   &lt;none&gt;        80:30816/TCP,443:31475/TCP   3h30m
</code></pre>
<p>In my case that is port 30816 (for http) and 31475 (for https).</p>
<p>Using NodePort type you can only use ports in range 30000-32767 (k8s docs: <a href="https://kubernetes.io/docs/concepts/services-networking/service/#nodeport" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/service/#nodeport</a>). You can change it using kube-apiserver flag <code>--service-node-port-range</code> and then set it to e.g. <code>80-32767</code> and then in your ingress-nginx-controller service set <code>nodePort: 80</code></p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  annotations: {}
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/version: 0.44.0
    helm.sh/chart: ingress-nginx-3.23.0
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
    nodePort: 80         # &lt;- HERE
  - name: https
    port: 443
    protocol: TCP
    targetPort: https
    nodePort: 443         # &lt;- HERE
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: NodePort
</code></pre>
<p>Although this is genereally not advised to change service-node-port-range since you may encounter some issues if you use ports that are already open on nodes (e.g. port 10250 that is opened by kubelet on every node).</p>
<hr />
<p>What might be a better solution is to use <a href="https://metallb.universe.tf/" rel="nofollow noreferrer">MetalLB</a>.</p>
<hr />
<p>EDIT:</p>
<blockquote>
<p>How can I get ingress to my jupyter-lab at <a href="http://jupyter-lab.local" rel="nofollow noreferrer">http://jupyter-lab.local</a> ???</p>
</blockquote>
<p>Assuming you don't need a failure tolerant solution, download the <code>https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.44.0/deploy/static/provider/baremetal/deploy.yaml</code> file and change <code>ports:</code> section for the deployment object like following:</p>
<pre><code>  ports:
    - name: http
      containerPort: 80
      hostPort: 80         # &lt;- add this line
      protocol: TCP
    - name: https
      containerPort: 443
      hostPort: 443        # &lt;- add this line
      protocol: TCP
    - name: webhook
      containerPort: 8443
      protocol: TCP
</code></pre>
<p>and apply the changes:</p>
<pre><code>kubectl apply -f deploy.yaml
</code></pre>
<p>Now run:</p>
<pre><code>$ kubectl get po -n ingress-nginx ingress-nginx-controller-&lt;HERE PLACE YOUR HASH&gt;  -owide
NAME                                        READY   STATUS    RESTARTS   AGE   IP           NODE       NOMINATED NODE   READINESS GATES
ingress-nginx-controller-67897c9494-c7dwj   1/1     Running   0          97s   172.17.0.6   &lt;node_name&gt;   &lt;none&gt;           &lt;none&gt;
</code></pre>
<p>Notice the &lt;node_name&gt; in NODE column. This is a node's name where the pod got scheduled. Now take this nodes IP and add it to your <code>/etc/hosts</code> file.</p>
<p>It should work now (go to <a href="http://jupyter-lab.local" rel="nofollow noreferrer">http://jupyter-lab.local</a> to check it), but this solution is fragile and if nginx ingress controller pod gets rescheduled to other node it will stop working (and it will stay lik this until you change the ip in /etc/hosts file). It's also generally not advised to use <code>hostPort:</code> field unless you have a very good reason to do so, so don't abuse it.</p>
<hr />
<p>If you need failure tolerant solution, use MetalLB and create a service of type LoadBalancer for nginx ingress controller.</p>
<p>I haven't tested it but the following should do the job, assuming that you correctly configured MetalLB:</p>
<pre><code>kubectl delete svc -n ingress-nginx ingress-nginx-controller
kubectl expose deployment -n ingress-nginx ingress-nginx-controller --type LoadBalancer
</code></pre>
