Here is my setup :

  • I have multiple LAN's on bare metals.
  • each LAN has a hardware router and has a static ip
  • each LAN has address range 192.168.1.*
  • external traffic usually comes to hardware router and then needs to be served by 1 of the service within the LAN

Need :

  • keep the LAN isolated sometimes(in few use cases) : like deploying an application to a LAN

Options :

  • Should i have 1 kubernetes OR 1 kubernetes for each LAN. 1 kubernetes per cluster would be a nightmare for me to manage so manage many clusters; I think 1 kubernetes overall is good.
  • for LAN specific deployments, should i create 1 namespace for each LAN or kubernetes labels are better to use or any other options
  • the external traffic usually comes via the static ip on hardware router, from there I need to route traffic usually within the LAN(thus ingress only within the LAN). How would ingress within the LAN would work.
  • also want to monitor, alarm and health check the entire cluster, namespace specific or label filtering.
  • if your lans are connected, you could try to manage with only one cluster – c4f4t0r Sep 9 at 9:50
  • No the LAN's are isolated – shrw Sep 10 at 0:08
  • I don't know your initial goal, but you can use networkpolicy in order to isolated you application from different networks. However, you need to choose wisely, during installation because not all CNI supports networkpolicy, Does networkpolicy solve you problem? – Marat Gainutdinov Sep 10 at 14:00
  • Entire cluster health could be checked via Prometheus or you can simply monitor logs from system-critical pods. – Marat Gainutdinov Sep 10 at 14:03
  • not sure how to check network policy .. i ma using Weave – shrw Sep 17 at 16:24

(at least) 1 kubernetes master. at least 1 worker node on each LAN, labeled as such. Hostnames alone may suffice. networkPolicy probably beneficial. Cluster health monitoring/alerting via Prometheus.

This strategy will require another LAN just for your cluster communication (at least 2 interfaces/host). VPN to that network may also be acceptable... When initializing the cluster, make sure you set the --apiserver-advertise-address IP and --control-plane-endpoint when you run kubeadm init. You can fix it after bootstrapping, but it's way easier to do at stand-up.

Choose your CNI carefully. I'm only familiar with flannel (combined with MetalLB) really...


| improve this answer | |
  • do i need to use VPN ? – shrw Sep 17 at 16:28
  • what cni will be good for me – shrw Sep 17 at 16:28
  • I use Flannel, with MetalLB. VPN should not be necessary, if you are able to set up the control network appropriately. I think VPN would only be necessary if the endpoints are geographically separated. But I could be wrong. Edit: Sorry for delay. – EbolaWare Sep 21 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.