Help with Claudie on Hetzner and Ingress daemonset #1730

hirschnase · 2025-04-08T19:06:04Z

hirschnase
Apr 8, 2025

Hello,

I just deployed my first little cluster with Claudie on Hetzner and trying to configure Ingress to get traffic routed from outside to my pods. Unfortunately I can't make it work and asking for help.

This is my input manifest - pretty standard:

apiVersion: claudie.io/v1beta1
kind: InputManifest
metadata:
  name: kubernetes-hetzner
spec:
  providers:
    - name: hetzner-secret
      providerType: hetzner
      secretRef:
        name: hetzner-secret
        namespace: default
  nodePools:
    dynamic:
      - name: hetzner-ctrl
        providerSpec:
          name: hetzner-secret
          region: fsn1
          zone: fsn1-dc14
        count: 1
        serverType: cpx21
        image: ubuntu-22.04

      - name: hetzner-cmpt
        providerSpec:
          name: hetzner-secret
          region: fsn1
          zone: fsn1-dc14
        count: 3
        serverType: cpx21
        image: ubuntu-22.04
        storageDiskSize: 50
  kubernetes:
    clusters:
      - name: hetzner-cluster
        version: v1.30.0
        network: 192.168.2.0/24
        pools:
          control:
            - hetzner-ctrl
          compute:
            - hetzner-cmpt

I started a httpd pod that answers on port 80

kubectl create deploy demo --image=httpd --port=80

and then installed ingress-nginx via a helm chart

helm install nginx-ingress ingress-nginx/ingress-nginx \
  --namespace ingress-nginx --create-namespace \
  --set controller.kind=DaemonSet \
  --set controller.daemonset.useHostPort=true \
  --set controller.hostPort.enabled=true \
  --set controller.service.type=ClusterIP \
  --set controller.publishService.enabled=false

The idea is to run the ingress as a daemonset on all nodes so that I can access any nodes external IP on port tcp/80 and access the service.

Finally I added the ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: demo-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
    - host: demo.local
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: demo
                port:
                  number: 80

I also enabled tcp/80 incoming traffic for any IP in the firewall which is attached to the nodes.

With all this done, I expected that a curl to one of the worker nodes external IP addresses would give me a response, but I only get a connection refused error - so nothing is answering on port 80 on the nodes.

Does anyone have an idea what's wrong/missing? Any help is appreciated.

hirschnase · 2025-04-09T07:43:56Z

hirschnase
Apr 9, 2025
Author

Ok, I found the problem. The privilege to bind to ports <1024 was missing. Now it works!

helm install nginx-ingress ingress-nginx/ingress-nginx \
  --namespace ingress-nginx --create-namespace \
  --set controller.kind=DaemonSet \
  --set controller.daemonset.useHostPort=true \
  --set controller.hostPort.enabled=true \
  --set controller.hostPort.http=80 \
  --set controller.hostNetwork=true \
  --set controller.service.enabled=false \
  --set controller.publishService.enabled=false \
  --set controller.containerSecurityContext.allowPrivilegeEscalation=true \
  --set controller.containerSecurityContext.capabilities.add[0]=NET_BIND_SERVICE

0 replies

hirschnase · 2025-04-09T08:04:30Z

hirschnase
Apr 9, 2025
Author

Problem solved.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Help with Claudie on Hetzner and Ingress daemonset #1730

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Help with Claudie on Hetzner and Ingress daemonset #1730

Uh oh!

hirschnase Apr 8, 2025

Replies: 2 comments

Uh oh!

Uh oh!

hirschnase Apr 9, 2025 Author

Uh oh!

hirschnase Apr 9, 2025 Author

hirschnase
Apr 8, 2025

hirschnase
Apr 9, 2025
Author

hirschnase
Apr 9, 2025
Author