RKE2-Canal

[Buzqi]

Calico allows to advertise svc IP without load balancer, Is there any way to access a pod IP using canal from a node that is outside of the cluster without the service type NodePort and without load balancer

[manuelbuil]

Calico allows to advertise svc IP without load balancer ==> where did you read that? AFAIK, Calico does not have any mechanism to expose external-ip to loadBalancer type services

[brandond]

Maybe they're referring to the ability to advertise pod and service ClusterIP addresses outside the cluster via bgp?

[manuelbuil]

Aaah good point, probably that's what the user is referring to. It should be possible by changing Canal variables, however, if you want to configure Canal with bgp backend, you are removing all the flannel need and thus, you are effectively using Calico only. Therefore, the question is, why don't you use Calico directly?

[Buzqi]

yeah that is what I was referring to, for compliance reason we are staying with canal, but the host that is sending the data is on the same network and subnet as the cluster, but however it is not part of the cluster. I was thinking maybe there is a way to send over data without advertising a service type load balancer. from my current setup, do you have any idea what I could try?

[manuelbuil]

If you want an external host to contact pods in the cluster, kubernetes official way to do this is via services of type Nodeport or of type LoadBalancer. Why do these solutions not fit your use case?

There are other alternatives but these are not recommended. For example, by using hostNetwork: true in the pod, which would provide the host's root network namespace and simplifies how you could connect to the pod. And since you are in the same network, you could also add to the external host routing table a path to reach one of the cluster's node ip route add default {NETWORK/MASK} via {GATEWAYIP}.

Using bgp could also be an alternative to the recommended solution but it increases the complexity of the solution (unless you are already using bgp to propagate routes)

[Buzqi]

To answer your question , the cluster is being hosted on prem without a load balancer. and I don't think NodePort would work as the application does not listen to a specific port and receive data. rather, the messages are send to 4 or more port on the pod and they are sent over UDP.

[manuelbuil]

Another option I forgot to mention is by using --enable-servicelb config in rke2. That would create a simple load-balancer for you when setting up services as Type: LoadBalancer. It will set the nodeIP as the externalIP for those services