TCP port on load balancer

[jampy]

I would like to make an SFTP server publicly accessible.

Can I configure ingress-nginx (and thus also the Hetzner load balancer) so that a specific TCP port is routed to a Kubernetes service?
I have looked at the page on load balancers and also at the annotations, but I am not clear how a TCP port can be configured or whether this is even possible.

There is a load-balancer.hetzner.cloud/protocol, but I don't think this can be used with a kind: Ingress.

[vitobotta]

Yes, you can expose TCP services with ingress-nginx. See https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/

[jampy]

Here is the solution, hoping that it may be helpful to someone:

Assuming that the load balancer is set up according to the hetzner-k3s recommendations, the following sections in values.yaml are important:

ingress-nginx:

  controller:
    kind: DaemonSet
    service:
      annotations:
        # (...load-balancer.hetzner.cloud/* annotations...)

    extraArgs:
      tcp-services-configmap: “ingress-nginx/tcp-services”

  tcp:
    “12345”: “12345”

• The tcp map defines the ports that should be automatically configured on the Hetzner load balancer
• extraArgs.tcp-services-configmap defines the name of a ConfigMap that maps the TCP ports from the Nginx load balancer to internal services (kind: Service)

This ConfigMap looks like this:

apiVersion: v1
kind: ConfigMap

metadata:
  name: tcp-services
namespace: ingress-nginx

data:
  “12345”: “whatever/some-tcp-service:22”

This works very well. However, it should be noted that a possible load-balancer.hetzner.cloud/uses-proxyprotocol: 'true' annotation also applies to all TCP ports.