Can NGF work using kind and localtest.me domain = 127.0.0.1 ?

[cmoulliard]

Hi,

I try to configure NGF on a kind cluster using localhost (= *.localtest.me) as IP address to access the URLs of the microservices but that fails. Help is more than welcome ;-)

Here are the steps I followed

// kind.cfg
apiVersion: kind.x-k8s.io/v1alpha4
kind: Cluster
nodes:
- role: control-plane
  extraPortMappings:
  - containerPort: 80
    hostPort: 8080
    protocol: TCP
  - containerPort: 443
    hostPort: 8443
    protocol: TCP

kind create cluster --config kind.cfg

// Install CRD and NGF
kubectl kustomize "https://github.com/nginxinc/nginx-gateway-fabric/config/crd/gateway-api/standard?ref=v1.5.0" | kubectl apply -f -
helm install ngf oci://ghcr.io/nginxinc/charts/nginx-gateway-fabric --create-namespace -n nginx-gateway --set service.type=ClusterIP

// Create the microservices
kubectl apply -f https://raw.githubusercontent.com/nginxinc/nginx-gateway-fabric/refs/heads/main/examples/cafe-example/cafe.yaml

// Gateway
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway
spec:
  gatewayClassName: nginx
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: "*.localtest.me"

kubectl apply -f gateway.yaml

// Create the routes
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: coffee
spec:
  parentRefs:
    - name: gateway
      sectionName: http
  hostnames:
    - "cafe.localtest.me"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /coffee
      backendRefs:
        - name: coffee
          port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: tea
spec:
  parentRefs:
    - name: gateway
      sectionName: http
  hostnames:
    - "tea.localtest.me"
  rules:
    - matches:
        - path:
            type: Exact
            value: /tea
      backendRefs:
        - name: tea
          port: 80

kubectl apply -f routes.yaml

But curl request failed

❯ curl -v http://cafe.localtest.me:8080
* Host cafe.localtest.me:8080 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8080...
* Connected to cafe.localtest.me (::1) port 8080
> GET / HTTP/1.1
> Host: cafe.localtest.me:8080
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
* Empty reply from server
* Closing connection
curl: (52) Empty reply from server

What is wrong with the config ?

[sindhushiv]

We need to port forward to the nginx service so that it can be accessed by the localhost, please try the following commands:

kubectl -n nginx-gateway port-forward svc/{your ngf service name} 8080:80 &
curl --resolve cafe.localtest.me:8080:127.0.0.1 http://cafe.localtest.me:8080/coffee

[cmoulliard]

Does it not work?

Yes if I use the port 8080 on my host (= macos laptop) but not using 80 as podman is running rootless and don't allow that

Error: rootlessport cannot expose privileged port 80, you can add 'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen tcp 0.0.0.0:80: bind: permission denied

[sjberman]

Ok so looks like you need to use port 8080 on your host due to that error, but the nginx container/service should still be allowed to run on 80 since it's within the kind cluster.

As seen in our getting started guide, the Service listens on port 80 and forwards to the container port 80, while still using the nodeport to allow the host port 8080 to forward to it.

[kate-osborn]

@cmoulliard if you want to use a hostPort instead of a nodePort, you do have to edit the containerPorts of the nginx container in the nginx-gateway deployment like @sindhushiv suggested. Then you will be able to send requests to localhost:8080 like you were trying to in your original post.

To answer your question:

Why do we have to do that ? If I install the Nginx ingress controller which is also exposing the following ports, we don't have to change them

The ingress-nginx controller does not add hostPort by default. However, their helm chart does allow you to configure them: https://github.com/kubernetes/ingress-nginx/blob/57b4a14af5a269627ba41c30c1bc6b68657da2f9/charts/ingress-nginx/values.yaml#L108. This configuration is something we can add support for in our helm chart. I will file an issue for this and post it here so you can follow it.

[kate-osborn]

#2933

[sjberman]

Thanks for clarifying @kate-osborn.

Sorry @cmoulliard I was going down the wrong path thinking that the goal was to use a NodePort.