6

That is my current solution:

LoadBalancer Instance with cloud -> Cluster NodePort Service -> Ingress Controller Service -> Ingress Controller Pod.

is it necessary to deploy the Ingress Controller using DaemonSet?

2 Answers 2

11

In a reasonably large cluster deploying ingress as deployment with multiple replicas is suitable compared to daemonset. When you are using deployment just make sure that replicas gets deployed in different nodes.You don't need a high number of NGINX instances to handle high volumes of traffic and most importantly, you need to keep in mind that each instance of the ingress controller needs to reach the kubernetes API server. This means if you have lots of replicas, you are putting (unnecessary) pressure. Using a deployment with an anti-affinity rule to avoid multiple replicas in the same node is, in most of the cases, more than enough

1
-1

As per my experience, Deamonset is preferred for ingress controller instead of deployment. We had an issue lately where the ingress-controller was running via a deployment and one of the nodes didn't have this pod allocated. Due to the same reason, the node was listed as "unhealthy" in the loadbalancer targergroup healthcheck.

Even Nginx recommend Daemonset, though a properly managed deployment will do the same job.

A DaemonSet schedules exactly one type of Pod per cluster node, masters included unless a node is configured to repel those Pods.

https://kubernetes.github.io/ingress-nginx/deploy/baremetal/

You may need to add taints and tolerations to exclude master nodes from daemonset as only worker need this pod running.

3
  • The fact that the nginx pod wasn't running on that node can't having anything to do with the node's health.
    – Lethargos
    Commented Apr 21, 2023 at 20:58
  • 1
    @Lethargos It absolutely does. This is exactly the reason why AWS network load balancers created by the Ingress Controller's LoadBalancer service on Kubernetes, show some nodes as unhealthy, precisely because they can't access pod on that node matching the service selector, as they try to contact all worker nodes of your cluster by default. This doesn't mean there is any actual issue in your infrastructure, it's just generic health check by AWS, but that's the exact reason.
    – adamency
    Commented Aug 17 at 13:10
  • @anrajme Your claim is wrong and false. Nowhere does the official Kubernetes Ingress Nginx project recommend using a DaemonSet for Nginx. The only mention of this in the link you provided is as a workaround for the very specific AND unsecure usecase of not using either a LoadBalancer nor a NodePort Service, i.e. not doing what >99.99% of Kubernetes production clusters use. The K8s Nginx project precisely recommends avoiding using a DaemonSet except for very small clusters, as it is waste of resource: github.com/kubernetes/ingress-nginx/issues/…
    – adamency
    Commented Aug 17 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.