CODEWITHSUNDEEP
centosiptablesgoogle-cloud-platformkubernetes
Suvitruf - Andrei Apanasik
Suvitruf - Andrei Apanasik

Reputation: 5672

Kubernetes external access to application in container

I'm using kubernates on my cluster on Digital Ocean.

I have application inside container in Pod. And i need to make external connection to this application. I need access to concrete instance (cause i have more than 10 Pod with this application).

So, my question is: how can i make external access to this application.

For example i have public IP 192.168.9.9

And have 2 pods with instances. First listen port 8990 and it's Pod IP is 10.0.0.1 and second listen port 8991 and it's Pod IP is 10.0.0.1.

So, i need to redirect traffic from 192.168.9.9:8990 to 10.0.0.1:8990 and 192.168.9.9:8991 to 10.0.0.1:8991.

Yes, i can do it by using iptables manually. But i want to do it automatically. When new Pod is up, i want to make record in iptables.

I can watch for services by using api:

127.0.0.1:8080/api/v1beta1/watch/services

And can get ip of pod here:

127.0.0.1:8080/api/v1beta1/pods

I found solution that do something similar to my needs here. But it looks like poor architectural decision. Is it better way to redirect external traffic to pod automatically after new Pod is up?

Upvotes: 0

Views: 1220

Answers (1)

larsks
larsks

Reputation: 312360

If your public ip is configured on an interface on one of your minions, then all you need to do is set the publicIPs value in your service description. For example, if you define a service like this:

kind: Service
apiVersion: v1beta1
id: test-web
port: 8888
selector:
  name: test-web
containerPort: 80
publicIPs:
  - 192.168.1.43

Then Kubernetes will create iptables rules like this:

-A KUBE-PORTALS-CONTAINER -d 192.168.1.43/32 -p tcp -m comment --comment test-web -m tcp --dport 8888 -j REDIRECT --to-ports 38541
-A KUBE-PORTALS-HOST -d 192.168.1.43/32 -p tcp -m comment --comment test-web -m tcp --dport 8888 -j DNAT --to-destination 192.168.1.20:38541

These rules redirect traffic to your publicIP and port to the appropriate port maintained by the local kube-proxy instance. I only wrote kiwi (and I'm sorry you don't like it!) to provide a mechanism for dynamically allocating public ip addresses. As long as you don't mind pre-configuring the addresses on your interfaces, you should be all set.

Upvotes: 6

Related Questions