<p>I've setup an ingress resource to route requests to single service.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    #kubernetes.io/ingress.class: nginx
    #ingress.kubernetes.io/rewrite-target: /

spec:
  defaultBackend:
    service:
      name: dashboard
      port:
        number: 80
</code></pre>
<pre class="lang-sh prettyprint-override"><code>$ kubectl get ing
NAME              CLASS    HOSTS   ADDRESS         PORTS   AGE
example-ingress   &lt;none&gt;   *       102.16.50.202   80      3m28s
</code></pre>
<p>The nginx-controller:</p>
<pre class="lang-sh prettyprint-override"><code>$ kubectl get pods -n ingress-nginx
NAME                                        READY   STATUS      RESTARTS      AGE
ingress-nginx-admission-create--1-gl59f     0/1     Completed   0             15h
ingress-nginx-admission-patch--1-9kbz6      0/1     Completed   0             15h
ingress-nginx-controller-54d8b558d4-2ss8f   1/1     Running     1 (13h ago)   15h

$ kubectl get svc -n ingress-nginx
NAME                                 TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                      AGE
ingress-nginx-controller             LoadBalancer   10.233.48.242   102.16.50.202   80:31690/TCP,443:32666/TCP   15h
ingress-nginx-controller-admission   ClusterIP      10.233.17.68    &lt;none&gt;          443/TCP                      15h
</code></pre>
<p>I'm able to reach and get response from the service via the controller's cluster IP:</p>
<pre class="lang-sh prettyprint-override"><code>$ curl -i 10.233.48.242
HTTP/1.1 200 OK
Date: Tue, 08 Feb 2022 04:50:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 2306
Connection: keep-alive
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 25 Jan 2022 09:35:14 GMT
ETag: W/&quot;902-17e9096e050&quot;
...
</code></pre>
<p>But not on its (nginx-controller's) external IP address:</p>
<pre class="lang-sh prettyprint-override"><code>$ curl -i 102.16.50.202
curl: (7) Failed to connect to 102.16.50.202 port 80: Connection refused

$ curl -i http://102.16.50.202
curl: (7) Failed to connect to 102.16.50.202 port 80: Connection refused

$ curl -i http://102.16.50.202/
curl: (7) Failed to connect to 102.16.50.202 port 80: Connection refused
</code></pre>
<p>I tried creating a new path (prefix), changed service type to NodePort, disabled the firewall, with no success; same issue.</p>
<p>Any observation or input would help a lot. Thanks.</p>
<h5>Edit-1:</h5>
<p>The nginx ingress controller is installed (<code>kubectl apply</code>) without modifying the <a href="https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml" rel="nofollow noreferrer">default configuration</a>:</p>
<pre class="lang-yaml prettyprint-override"><code>#file: ingress-controller-deploy.yml
...
apiVersion: v1
kind: Service
metadata:
  annotations:
  labels:
    helm.sh/chart: ingress-nginx-4.0.15
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: 1.1.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  ipFamilyPolicy: SingleStack
  ipFamilies:
    - IPv4
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
      appProtocol: http
    - name: https
      port: 443
      protocol: TCP
      targetPort: https
      appProtocol: https
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/component: controller
</code></pre>
<p>The <a href="https://www.asykim.com/blog/deep-dive-into-kubernetes-external-traffic-policies" rel="nofollow noreferrer">externalTrafficPolicy:Local</a> seems to be ok if I'm using a load balancer, which in my case is <a href="https://metallb.universe.tf/" rel="nofollow noreferrer">MetalLB </a>.</p>
<pre class="lang-yaml prettyprint-override"><code>#file: ingress-controller-deploy.yml
apiVersion: apps/v1
kind: Deployment
...
          securityContext:
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
            runAsUser: 101
            allowPrivilegeEscalation: true
</code></pre>
<p>The <code>securityContext</code> section seems ok too.</p>

Deepak D
<p>After reading tons of docs and github issues I came to conclusion than on bare-metal setup without editing ingress controller deploy.yaml (like adding <code>hostNetwork: true</code>) you can't access exposed ingress IP address by port 80.
However, if you specify port which is displayed in service <code>ingress-nginx-controller</code>  then you can successfully access exposed service from external network.</p>
<p>My steps:</p>
<ul>
<li>install ingress controller</li>
</ul>
<p><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.2.0/deploy/static/provider/baremetal/deploy.yaml</code></p>
<ul>
<li>launch echo server (yaml files taken from <a href="https://www.sanderverbruggen.com/add-an-http-echo-service-to-your-kubernetes-cluster/" rel="nofollow noreferrer">echo server</a> )</li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: echo-deployment
spec:
  replicas: 2
  selector:
    matchLabels:
      app: echo-server
  template:
    metadata:
      labels:
        app: echo-server
    spec:
      containers:
        - name: echo-server
          image: jmalloc/echo-server
          ports:
            - name: http-port
              containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: echo-service
spec:
  ports:
    - name: http-port
      port: 80
      targetPort: http-port
      protocol: TCP
  selector:
    app: echo-server
</code></pre>
<ul>
<li>install ingress</li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: echo-ingress
    spec:
      rules:
      - host: echo.k8s-test
        http:
          paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: echo-service
                port:
                  number: 80
      ingressClassName: nginx
</code></pre>
<ul>
<li>While ingress is aquiring IP address lets check data on ingress-nginx-controller:</li>
</ul>
<pre class="lang-bash prettyprint-override"><code>$ kubectl get svc ingress-nginx-controller -n ingress-nginx
NAME                       TYPE       CLUSTER-IP     EXTERNAL-IP   PORT(S)                      AGE
ingress-nginx-controller   NodePort   10.105.96.55   &lt;none&gt;        80:30097/TCP,443:32746/TCP   82m
</code></pre>
<p><b>Note port 30097</b></p>
<ul>
<li>Check ingress status</li>
</ul>
<pre class="lang-bash prettyprint-override"><code>$ kubectl get ing echo-ingress
NAME           CLASS   HOSTS           ADDRESS           PORTS   AGE
echo-ingress   nginx   echo.k8s-test   192.168.122.222   80      81m
</code></pre>
<p>192.168.122.222 is IP assigned to NIC on one of worker nodes.</p>
<p>Now, from outside k8s cluster, we can access</p>
<pre class="lang-bash prettyprint-override"><code>$ curl http://192.168.122.222:30097 -H &quot;Host: echo.k8s-test&quot;
Request served by echo-deployment-8586b5977c-pt2pp

HTTP/1.1 GET /

Host: echo.k8s-test
User-Agent: curl/7.47.0
Accept: */*
X-Real-Ip: 10.244.1.1
X-Forwarded-Host: echo.k8s-test
X-Forwarded-Proto: http
X-Forwarded-Scheme: http
X-Scheme: http
X-Request-Id: 188379f183fe0c3e7ddc612b85d0d76d
X-Forwarded-For: 10.244.1.1
X-Forwarded-Port: 80
</code></pre>
