Accessing exposed service from inside

[Biacode]

Hello,
I have configured the cert manager with Nginx ingress. While everything works from outside the K8S cluster, I can't access exposed services from inside the POD.
Trying to curl from inside pod curl -v https://my-service-public-domain.com
It gives me the following error.

* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x5571e11270f0)
* Connected to my-service-public-domain.com (xxx.xxx.xxx.xxx) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to my-service-public-domain.com:443 
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to my-service-public-domain.com:443

Changing the controller config from use-proxy-protocol: true to use-proxy-protocol: false makes it work exactly the opposite - now I can access the service internally but not externally.

[ifeulner]

I think you hit the problem that an internal request to the load balancer does not go through the external ip and so does not use the PROXY protocol. This seems to be some long known kubernetes problem and is addressed with a potential solution here: hetznercloud/hcloud-cloud-controller-manager#58 (comment).
The suggestion is to annotate the service with load-balancer.hetzner.cloud/hostname: your-ingress.acme.corp.

Don't know yet how we should handle this best "out-of-the-box"?

[Biacode]

Thanks, @ifeulner.
I am not sure where should I put this property.
On kind: Service where do I expose my deployment/pod?
At the end of the kube.tf? If this is the case, should I do this before installing the cluster using this repo?
Also, should I use the subdomain that I am targeting for this particular service? Or it should be the root domain?
Thanks

[mysticaltech]

@Biacode You can try to the end of the kube.tf file via the nginx_ingress_values variable, basically you have to put it under service -> annotations, normally it should install the updated service for you.

Otherwise, just pull the service with kubectl get svc -o yaml, edit and apply it with -f option. You can also use kubectl edit, but not very infra as code.

It should be the full hostname that points to the LB IP, it does not matter if you have this set up on the root domain or the subname. If you are not sure, just check your DNS root file.

[pmig]

Additional info: The service of type LoadBalancer is called ngx-ingress-nginx-controller in the namespace kube-system

[mysticaltech]

Converting this to a discussion, where it belongs better :)

[Biacode]

Thanks, @mysticaltech.
Yes, it works now.
What do you suggest, or what is the best practice for modifying this setting instead of pulling them from the cluster and modifying them manually?
I tried with the terraform, but it doesn't generates terraform changes.

[mysticaltech]

@Biacode Ok, good to know about applying via terraform, I actually had doubts about this.

My advice is that you just use good old GitOps practices, pull down the services to yaml, edit, push and saved your state in git somewhere. What you could also do is use something like Flux or ArgoCD to have it deploy those git changes for you, but that is optional.