<p>I have a timeout problem with my site hosted on Kubernetes cluster provided by DigitalOcean.</p>

<pre><code>u@macbook$ curl -L fork.example.com
curl: (7) Failed to connect to fork.example.com port 80: Operation timed out
</code></pre>

<p>I have tried everything listed on the <a href="https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/#is-the-kube-proxy-working" rel="nofollow noreferrer">Debug Services</a> page. I use a k8s service named <code>df-stats-site</code>.</p>

<pre><code>u@pod$ nslookup df-stats-site
Server:     10.245.0.10
Address:    10.245.0.10#53

Name:   df-stats-site.deepfork.svc.cluster.local
Address: 10.245.16.96
</code></pre>

<p>It gives the same output when I do it from node:</p>

<pre><code>u@node$ nslookup df-stats-site.deepfork.svc.cluster.local 10.245.0.10
Server:     10.245.0.10
Address:    10.245.0.10#53

Name:   df-stats-site.deepfork.svc.cluster.local
Address: 10.245.16.96
</code></pre>

<p>With the help of <strong><em>Does the Service work by IP?</em></strong> part of the page, I tried the following command and got the expected output.</p>

<pre><code>u@node$ curl 10.245.16.96
*correct response*
</code></pre>

<p>Which should mean that everything is fine with DNS and service. I confirmed that <code>kube-proxy</code> is running with the following command:</p>

<pre><code>u@node$ ps auxw | grep kube-proxy
root  4194  0.4  0.1 101864 17696 ?    Sl Jul04  13:56 /hyperkube proxy  --config=...
</code></pre>

<p>But I have something wrong with <code>iptables</code> rules:</p>

<pre><code>u@node$ iptables-save | grep df-stats-site
(unfortunately, I was not able to copy the output from node, see the screenshot below)
</code></pre>

<p><a href="https://i.stack.imgur.com/SbZMN.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/SbZMN.jpg" alt="screenshot"></a></p>

<p>It is recommended to restart <code>kube-proxy</code> with with the <code>-v</code> flag set to 4, but I don't know how to do it with DigitalOcean provided cluster.</p>

<p>That's the configuration I use:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: df-stats-site
spec:
  ports:
  - port: 80
    targetPort: 8002
  selector:
    app: df-stats-site

---

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: df-stats-site
  annotations:
    kubernetes.io/ingress.class: nginx
    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
  - hosts:
    - fork.example.com
    secretName: letsencrypt-prod
  rules:
  - host: fork.example.com
    http:
      paths:
      - backend:
          serviceName: df-stats-site
          servicePort: 80
</code></pre>

<p>Also, I have a NGINX Ingress Controller set up with the help of <a href="https://stackoverflow.com/a/55968709/7211294">this answer</a>.</p>

<p>I must note that it worked fine before. I'm not sure what caused this, but restarting the cluster would be great, though I don't know how to do it without removing all the resources.</p>

stasdeep
<p>The solution for me was to add HTTP and HTTPS inbound rules in the Firewall (these are missing by default).</p>

<p>For DigitalOcean provided Kubernetes cluster, you can open it at <a href="https://cloud.digitalocean.com/networking/firewalls/" rel="nofollow noreferrer">https://cloud.digitalocean.com/networking/firewalls/</a>.</p>

<p><strong>UPDATE:</strong> Make sure to create a new firewall record rather than editing an existing one. Otherwise, your rules will be automatically removed in a couple of hours/days, because DigitalOcean k8s persists the set of rules in the firewall.</p>
