a design question, why rke2 installs ingress-nginx controller by ds with host network, any design consideration?

I believe it was changed at one point, but currently it's configured as such to mimic how the built in ingress controller in RKE1 operates, which is also partly for ease.

i thought it might be due to some nodePort svc drawbacks, thanks David.

I created an RKE2 cluster w/ Harvester Cloud Provider and encountered this too. For me the solution was a LoadBalancer service selecting the daemonset's pods. I created a vip-pool in the Harvester node to supply an external IP for the service.

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx-loadbalancer
spec:
  selector:
    <http://app.kubernetes.io/name|app.kubernetes.io/name>: rke2-ingress-nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
      name: http
    - protocol: TCP
      port: 443
      targetPort: 443
      name: https
  type: LoadBalancer