<pre><code>Operating System: CentOS Linux 7 (Core)
CPE OS Name: cpe:/o:centos:centos:7
Kernel: Linux 3.10.0-1160.45.1.el7.x86_64
</code></pre>
<p>I am using an external load balancer HAProxy and Keepalived. My Virtual IP 172.24.16.6. If I create a service with NodePort, then i can connect from outside to pod. This is the premise that IP from the load balancer is available to my cluster.</p>
<p>Im installed NGINX Ingress Controller via this instruction <a href="https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/" rel="nofollow noreferrer">https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/</a></p>
<p>I also applied <code>$ kubectl apply -f service/loadbalancer.yaml</code> with with such parameters:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress
  namespace: nginx-ingress
spec:
  externalTrafficPolicy: Local
  type: LoadBalancer
  externalIPs:
  - 172.24.16.6
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: http
  - port: 443
    targetPort: 443
    protocol: TCP
    name: https
  selector:
    app: nginx-ingress
</code></pre>
<p>As a result, it all looks like this:</p>
<pre><code>]$ kubectl get all -o wide -n nginx-ingress
NAME                                 READY   STATUS    RESTARTS   AGE   IP                NODE                          NOMINATED NODE   READINESS GATES
pod/nginx-ingress-768698d9df-c2wlx   1/1     Running   0          27m   192.168.105.197   srv-dev-k8s-worker-05   &lt;none&gt;           &lt;none&gt;

NAME                    TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE   SELECTOR
service/nginx-ingress   LoadBalancer   10.104.239.149   172.24.16.6   80:30053/TCP,443:30021/TCP   22m   app=nginx-ingress

NAME                            READY   UP-TO-DATE   AVAILABLE   AGE   CONTAINERS      IMAGES                      SELECTOR
deployment.apps/nginx-ingress   1/1     1            1           28m   nginx-ingress   nginx/nginx-ingress:2.0.2   app=nginx-ingress

NAME                                       DESIRED   CURRENT   READY   AGE   CONTAINERS      IMAGES                      SELECTOR
replicaset.apps/nginx-ingress-6454cfbc49   0         0         0       28m   nginx-ingress   nginx/nginx-ingress:2.0.2   app=nginx-ingress,pod-template-hash=6454cfbc49
replicaset.apps/nginx-ingress-768698d9df   1         1         1       27m   nginx-ingress   nginx/nginx-ingress:2.0.2   app=nginx-ingress,pod-template-hash=768698d9df
</code></pre>
<p>nginx-ingress pod:</p>
<pre><code>$ kubectl -n nginx-ingress get pod -o wide
NAME                             READY   STATUS    RESTARTS   AGE   IP                NODE                          NOMINATED NODE   READINESS GATES
nginx-ingress-768698d9df-c2wlx   1/1     Running   0          72m   192.168.105.197   srv-dev-k8s-worker-05   &lt;none&gt;           &lt;none&gt;
</code></pre>
<p>The <code>netstat</code> shows that ports 80 and 443 are open and bound to 172.24.16.6:</p>
<pre><code>$ netstat -tulpn
(No info could be read for &quot;-p&quot;: geteuid()=1002 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 172.24.16.6:80          0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:10257         0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:179             0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:10259         0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 172.24.16.6:443         0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:43707         0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:32000           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:30021           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:30053           0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:10248         0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:10249         0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:9098          0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:9099          0.0.0.0:*               LISTEN      -
tcp        0      0 172.24.25.141:2379      0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:2379          0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:6444          0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:6444            0.0.0.0:*               LISTEN      -
tcp        0      0 172.24.25.141:2380      0.0.0.0:*               LISTEN      -
tcp6       0      0 :::10256                :::*                    LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -
tcp6       0      0 :::31231                :::*                    LISTEN      -
tcp6       0      0 :::5473                 :::*                    LISTEN      -
tcp6       0      0 :::10250                :::*                    LISTEN      -
tcp6       0      0 :::6443                 :::*                    LISTEN      -
udp        0      0 127.0.0.1:323           0.0.0.0:*                           -
udp        0      0 0.0.0.0:4789            0.0.0.0:*                           -
udp        0      0 0.0.0.0:58191           0.0.0.0:*                           -
udp        0      0 0.0.0.0:68              0.0.0.0:*                           -
udp6       0      0 ::1:323                 :::*                                -
</code></pre>
<p>But <code>iptables</code> don't open any ports <a href="https://pastebin.com/BvV32sjD" rel="nofollow noreferrer">https://pastebin.com/BvV32sjD</a></p>
<p>Please help me to access from outside.</p>

Maksim
<p>Yes, i added ingress to namespace for-only-test.</p>
<pre><code>$ kubectl get all -o wide
NAME                                    READY   STATUS    RESTARTS   AGE    IP               NODE                          NOMINATED NODE   READINESS GATES
pod/nginx-deployment-559d658b74-6p4tb   1/1     Running   0          179m   192.168.240.70   srv-dev-k8s-worker-08   &lt;none&gt;           &lt;none&gt;
pod/nginx-deployment-559d658b74-r96s9   1/1     Running   0          179m   192.168.240.71   srv-dev-k8s-worker-08   &lt;none&gt;           &lt;none&gt;

NAME                       TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE    SELECTOR
service/nginx-deployment   ClusterIP   10.108.39.147   &lt;none&gt;        80/TCP    178m   app=nginx

NAME                               READY   UP-TO-DATE   AVAILABLE   AGE    CONTAINERS   IMAGES         SELECTOR
deployment.apps/nginx-deployment   2/2     2            2           3h1m   nginx        nginx:1.16.1   app=nginx

NAME                                          DESIRED   CURRENT   READY   AGE    CONTAINERS   IMAGES         SELECTOR
replicaset.apps/nginx-deployment-559d658b74   2         2         2       179m   nginx        nginx:1.16.1   app=nginx,pod-template-hash=559d658b74
</code></pre>
<p>Then created ingress:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-for-nginx-deployment
  annotations:
#    kubernetes.io/ingress.class: &quot;nginx&quot;
#    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: k8s.domain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-deployment
            port:
              number: 80
</code></pre>
<pre><code>$ kubectl get ingress -o wide
NAME                           CLASS   HOSTS              ADDRESS   PORTS   AGE
ingress-for-nginx-deployment   nginx   k8s.domain.com             80      7s
</code></pre>
