Kubernetes Network Models (why is this so dang hard?)

Originally prepared to be read, I modified the original to be presented at CNCF Webinar.

Transcript

1. Kubernetes Network Models Tim Hockin, Google Sept. 10, 2020 @thockin
3. Kubernetes clusters are made up of nodes • Machines - virtual or physical Those nodes exist on some network Pods run on those nodes Pods get IP addresses “Network model” describes how those pod IPs integrate with the larger network What does “network model” mean?
4. Wait, what?
5. 1) Pods on a node can communicate with all pods on all nodes without NAT 2) Agents on a node (e.g. system daemons, kubelet) can communicate with all pods on that node Kubernetes networking in 2 bullets
6. Let’s start with a “normal” cluster
7. Network: 10.0.0.0/8
8. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16
9. NOTE: It’s not required that a cluster be a single IP range, but it’s very common and makes the pictures easier
10. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16
11. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Node2: IP: 10.240.0.2
12. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24
13. NOTE: It’s not required that nodes have a predefined IP range, but it’s very common and makes the pictures easier
14. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24
15. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-b: 10.0.1.2 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2
16. Pods get IPs from the node’s IP range (again, not always, but usually)
17. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-b: 10.0.1.2 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2
18. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-b: 10.0.1.2 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2
19. Kubernetes does not say anything about things outside of the cluster
20. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-b: 10.0.1.2 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Other: 10.128.1.1 ? Other: 10.128.1.2 ?
21. Multi-cluster makes it even more confusing
22. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: IP: 10.240.0.3 Pod range: 10.1.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.1.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 ? ? Other: 10.128.1.2 ?
23. Network models (not exhaustive)
24. Fully-integrated (aka flat)
25. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: IP: 10.240.0.3 Pod range: 10.1.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.1.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Other: 10.128.1.2
26. Good when: • IP space is readily available • Network is programmable / dynamic • Need high integration / performance • Kubernetes is a large part of your footprint
27. Bad when: • IP fragmentation / scarcity • Hard-to-configure network infrastructure • Kubernetes is a small part of your footprint
28. Fully-isolated (aka air-gapped)
29. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: IP: 10.240.0.3 Pod range: 10.1.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.1.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Other: 10.128.1.2
30. In fact, you can re-use all of the IPs
31. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 same!
32. In fact, they are basically on different networks
33. Network: 10.0.0.0/8 Network: 10.0.0.0/8 Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
34. Good when: • Don’t need integration • IP space is scarce / fragmented • Network is not programmable / dynamic • May be easier to reason about security boundaries
35. Bad when: • Need communication across a cluster-edge
36. Bridged (aka island mode)
37. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: IP: 10.240.0.3 Pod range: 10.1.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.1.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 gateway gateway gateway Other: 10.128.1.2
38. You can re-use the Pod IPs in each cluster (a major motivation for this model)
39. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 gateway gateway gateway Other: 10.128.1.2 same!
40. Good when: • Need some integration • IP space is scarce / fragmented • Network is not programmable / dynamic
41. Bad when: • Need to debug connectivity • Need direct-to-endpoint communications • Need a lot of services exposed (especially non-HTTP) • Rely on client IPs for firewalls • Large number of nodes
42. Various forms of “gateway”
43. Gateway: nodes
44. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.0.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
45. Ingress: Service NodePorts
46. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
47. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
48. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
49. Node uses IP dst_port to route to correct service (DNAT)
50. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
51. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
52. You can ingress L4 into an L7 proxy and forward from there (e.g. in-cluster ingress controllers)
53. Egress: IP Masquerade (aka SNAT)
54. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
55. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
56. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
57. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
58. SNAT obscures client IP (Traffic from pods on a node appears to come from that node’s IP)
59. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
60. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
61. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Other: 10.128.1.2
62. Gateway: VIP (ingress)
63. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 VIP VIP Other: 10.128.1.2
64. Similar to NodePort, but node uses IP dst_ip to route
65. Still needs something like SNAT to egress
66. Gateway: Proxy (ingress)
67. Network: 10.0.0.0/8 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: 10.0.1.0/24 Node2: 10.0.2.0/24 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: 10.1.1.0/24 Node2: 10.1.2.0/24 Node1: IP: 10.240.0.3 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Proxy Proxy Other: 10.128.1.2
68. Can either route to NodePort or directly to pod IPs (e.g. proxy knows how to “get onto the island”)
69. Proxy obscures client IP (Traffic appears to come from the proxy’s IP)
70. Still needs something like SNAT to egress
71. There’s a LOT more to know about ingress (for another presentation)
72. Options for egress are poorly explored, so far
73. Archipelago (aka bigger islands)
74. Network: 10.0.0.0/8 Cluster: 10.0.0.0/16 Other: 10.128.1.1 Cluster: 10.0.0.0/16 Node1: IP: 10.240.0.1 Pod range: 10.0.1.0/24 Node2: IP: 10.240.0.2 Pod range: 10.0.2.0/24 Pod-a: 10.0.1.1 Pod-c: 10.0.2.1 Pod-d: 10.0.2.2 Pod-b: 10.0.1.2 Cluster: 10.1.0.0/16 Node1: IP: 10.240.0.3 Pod range: 10.1.1.0/24 Node2: IP: 10.240.0.4 Pod range: 10.1.1.0/24 Pod-a: 10.1.1.1 Pod-c: 10.1.2.1 Pod-d: 10.1.2.2 Pod-b: 10.1.1.2 gateway Other: 10.128.1.2 gateway
75. Can’t reuse pod IPs between clusters, but can between archipelagos
76. Good when: • Need high integration across clusters • Need some integration with non-kubernetes • IP space is scarce / fragmented • Network is not programmable / dynamic
77. Bad when: • Need to debug connectivity • Need direct-to-endpoint communications • Need a lot of services exposed to non-k8s • Rely on client IPs for firewalls • Large number of nodes across all clusters
78. Gateway options are similar to plain island mode
79. Which one should you use?
80. There is no “right answer”. You have to consider the tradeoffs. Sorry.
81. Questions?
82. Sept 25: Ambassador webinar Kaslin Fields and Bowei Du will present the webinar “The evolution of Ingress through the Gateway API” Follow https://www.cncf.io/upcoming-webinars/ for more details