Networking
Ingress traffic
Ingress to Service
The vCluster has the option to enable Ingress resources synchronization. That means that you can create an ingress in a vCluster to make a service in this vCluster available via a hostname/domain. However, instead of having to run a separate ingress controller in each vCluster, the ingress resource synchronizes to the underlying cluster (when enabled) which means that the vCluster can use a shared ingress controller that is running in the control plane cluster. This helps to share resources across different tenant clusters and is easier for users of tenant clusters because otherwise, they would need to install an ingress controller and manually configure DNS for each vCluster.
From inside a tenant cluster
Pod in the tenant cluster to Pod in the same tenant cluster
Pods run inside the underlying control plane cluster. vCluster's syncer component syncs Pods between control plane cluster and tenant cluster. These synced Pods have cluster-internal IP addresses and can communicate with each other via IP-based networking.
No additional configuration is required for Pod to Pod networking in the same tenant cluster.
Pod in the tenant cluster to Service in the same tenant cluster
To allow pods to communicate with services, vCluster also synchronizes Service objects, while stripping away unnecessary information from the resource. However, instead of using the DNS names of the Services inside the control plane cluster, vCluster has its own DNS service which allows tenant cluster pods to use much more intuitive DNS mappings, just as in a regular cluster.
No additional configuration is required for Pod to Service networking in the same tenant cluster.
Pod in the tenant cluster to Service in the control plane cluster
See Control plane cluster to tenant cluster.
Pod in the tenant cluster to Service in a different tenant cluster
See Mapping services across vCluster instances.
From the control plane cluster
Pod in the control plane cluster to Service in the tenant cluster
See Tenant cluster to control plane cluster
Service CIDR and Pod CIDR
To configure service cidr or pod cidr of the vCluster, e.g.:
privateNodes:
enabled: true
networking:
podCIDR: 10.64.0.0/16
serviceCIDR: 10.128.0.0/16
Config reference
networking object
Networking options related to the virtual cluster.
networking object serviceCIDR string
ServiceCIDR holds the service cidr for the virtual cluster. This should only be set if privateNodes.enabled is true or vCluster cannot detect the host service cidr.
serviceCIDR string podCIDR string 10.244.0.0/16
PodCIDR holds the pod cidr for the virtual cluster. This should only be set if privateNodes.enabled is true.
podCIDR string 10.244.0.0/16 replicateServices object
ReplicateServices allows replicating services from the host within the virtual cluster or the other way around.
replicateServices object toHost object[]
ToHost defines the services that should get synced from virtual cluster to the host cluster. If services are
synced to a different namespace than the virtual cluster is in, additional permissions for the other namespace
are required.
toHost object[] from string
From is the service that should get synced. Can be either in the form name or namespace/name.
from string to string
To is the target service that it should get synced to. Can be either in the form name or namespace/name.
to string fromHost object[]
FromHost defines the services that should get synced from the host to the virtual cluster.
fromHost object[] from string
From is the service that should get synced. Can be either in the form name or namespace/name.
from string to string
To is the target service that it should get synced to. Can be either in the form name or namespace/name.
to string resolveDNS object[]
ResolveDNS allows to define extra DNS rules. This only works if embedded coredns is configured.
resolveDNS object[] hostname string
Hostname is the hostname within the vCluster that should be resolved from.
hostname string service string
Service is the virtual cluster service that should be resolved from.
service string namespace string
Namespace is the virtual cluster namespace that should be resolved from.
namespace string target object
Target is the DNS target that should get mapped to
target object hostname string
Hostname to use as a DNS target
hostname string ip string
IP to use as a DNS target
ip string hostService string
HostService to target, format is hostNamespace/hostService
hostService string hostNamespace string
HostNamespace to target
hostNamespace string vClusterService string
VClusterService format is hostNamespace/vClusterName/vClusterNamespace/vClusterService
vClusterService string advanced object
Advanced holds advanced network options.
advanced object clusterDomain string cluster.local
ClusterDomain is the Kubernetes cluster domain to use within the virtual cluster.
clusterDomain string cluster.local fallbackHostCluster boolean false
FallbackHostCluster allows to fallback dns to the host cluster. This is useful if you want to reach host services without
any other modification. You will need to provide a namespace for the service, e.g. my-other-service.my-other-namespace
fallbackHostCluster boolean false proxyKubelets object
ProxyKubelets allows rewriting certain metrics and stats from the Kubelet to "fake" this for applications such as
prometheus or other node exporters.
proxyKubelets object byHostname boolean true
ByHostname will add a special vCluster hostname to the nodes where the node can be reached at. This doesn't work
for all applications, e.g. Prometheus requires a node IP.
byHostname boolean true byIP boolean true
ByIP will create a separate service in the host cluster for every node that will point to virtual cluster and will be used to
route traffic.
byIP boolean true