<p>I'm running a Kubernetes cluster in a public cloud (Azure/AWS/Google Cloud), and I have some non-HTTP services I'd like to expose for users.</p>

<p>For HTTP services, I'd typically use an Ingress resource to expose that service publicly through an addressable DNS entry.</p>

<p>For non-HTTP, TCP-based services (e.g, a database such as PostgreSQL) how should I expose these for public consumption?</p>

<p>I considered using <code>NodePort</code> services, but this requires the nodes themselves to be publicly accessible (relying on <code>kube-proxy</code> to route to the appropriate node). I'd prefer to avoid this if possible.</p>

<p><code>LoadBalancer</code> services seem like another option, though I don't want to create a dedicated cloud load balancer for <em>each</em> TCP service I want to expose.</p>

<p>I'm aware that the <a href="https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/" rel="noreferrer">NGINX Ingress controller supports exposing TCP and UDP services</a>, but that seems to require a static definition of the services you'd like to expose. For my use case, these services are being dynamically created and destroyed, so it's not possible to define these service mappings upfront in a static <code>ConfigMap</code>.</p>

cjheppell
<p>Maybe this workflow can help:</p>

<p>(I make the assumption that the cloud provider is AWS)</p>

<ul>
<li><p><strong>AWS Console:</strong> Create a segregated VPC and create your Kubernetes ec2 instances (or autoscaling group) disabling the creation of public IP.  This makes it impossible to access the instance from the Internet, you still can access through the private IP (ex, 172.30.1.10) via a Site 2 Site VPN or through a secondary ec2 instance in the same VPC with Public IP. </p></li>
<li><p><strong>Kubernetes:</strong> Create a service with a Fixed NodePort (eg 35432 for Postgres).</p></li>
<li><p><strong>AWS console:</strong> create a Classic o Layer 4 Loadblancer inside the same VPC of your nodes, in the Listeners Tab open the port 35432 (and other ports that you might need)   pointing to one or all of your nodes via a "Target Group".  There is no charge in the number of ports.  </p></li>
</ul>

<p>At this point, I don't know how to automate the update of the current living nodes in the Load Balancer's Target Group, this maybe could be an issue with Autoscaling features, if any... Maybe a Cron job with a bash script pulling info from AWS API and update the Target Group?</p>
