What IP address should kubernetes svc point to when k3s is listening on localhost?

[Magicloud]

I just installed k3s on a public host, with a bit security concern, I had k3s listening on localhost. Then I noticed traefik could not work because it tries to connect kubernetes service, which points to the public ip of the host. Expectedly it would not work.

What should I do?

[brandond]

It needs to be available on non-loopback address that is available to other cluster members.

[Magicloud]

As my understanding, that is true. And seems like that is the only way to work.

But in document and security/self-assessment, it is not mentioned (maybe I missed it) and encouraged to set to localhost. I think that is a bit confusing, even if I had only one node, binding to localhost would break ingress function.

[brandond]

I'm not aware of anywhere in our security guide that we say to restrict the apiserver to binding to the loopback address.
https://docs.k3s.io/security/hardening-guide

What exactly are you looking at?

[Magicloud]

Just realize that was my misunderstanding. Thanks for the help.