Question

Kubernetes NodePort not accessible, opened thru firewall

Posted on December 30, 2024
DigitalOcean Kubernetes
Asked by langsam

I’ve spent all ideas why the NodePort of my service isn’t accessible on the external IP of a K8S node. The port is added to public DO Firewall for my K8S cluster, but I can’t even telnet to that ip:port.

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Zeal Vora • January 18, 2025

This is the issue related to Managed K8s Offering by Digital Ocean. I have raised a support case and received following response:

====== The behavior you’re observing is related to an ongoing issue our team is aware of. Specifically, the connection from the internet to the NodePort service fails when the backend pod resides on a different subnet from the queried node. This scenario typically occurs when Cilium is running in eBPF mode with VPC-native networking, which creates a custom CIDR for the pods and places them on a different subnet than the node.

To resolve this issue, we recommend creating a new Kubernetes cluster in non-VPC-native mode with Cilium running in partial KPR mode. This configuration allows NodePort services to function correctly without encountering the connectivity issue. You can create a new cluster using the following doctl CLI command:

$ doctl kubernetes cluster create <cluster-name>
–region <region-slug>
–node-pool “name=<node-pool-name>;size=<node-size>;count=<node-count>”
–version <kubernetes-version>

======