This message was deleted.
# generala
adamant-kite-43734
10/12/2023, 5:00 PMThis message was deleted.
b
bland-article-62755
10/12/2023, 5:25 PMThere's a few different network layers. There's an internal k8s layer, and then there's the internal (backend) network between the nodes, and potentially an external network (that's public facing)
bland-article-62755
10/12/2023, 5:26 PMI'm guessing the CIDR block is for the backend network between nodes.
bland-article-62755
10/12/2023, 5:26 PMSo as you set up your nodes you can enable that by making sure your boxes/VMs are on that VLAN/block.
bland-article-62755
10/12/2023, 5:27 PMRancher will register/use the network when it bootstraps the cluster.
b
bulky-leather-83471
10/12/2023, 5:53 PM@bland-article-62755 the nodes are on a different CIDR block. The block given by the infra team is meant to be for kubernetes resources only. So, my question is can I use that block for the cluster so that the resources inside the cluster get an IP address within that CIDR block?
b
bland-article-62755
10/12/2023, 5:56 PMI'm pretty sure the CNI uses wireguard over the Node's CIDR block so it's not exposed that way.
bland-article-62755
10/12/2023, 5:57 PMIf there's a conflict, with what it uses by default with another VLAN I think there's a way to change that, but it's not exposed from outside the nodes.
bland-article-62755
10/12/2023, 5:57 PMThey're all encrypted differently so there's no need to specify VLAN per cluster.
bland-article-62755
10/12/2023, 5:57 PMit just works ™️
bland-article-62755
10/12/2023, 5:58 PMBasically even if you use that block, the switches/whatnot will never see it because of wireguard.
b
bulky-leather-83471
10/12/2023, 6:06 PMOkay. Got it. Basically, the scenario is that the application inside the pod has to authenticate with the customer's own AD for which we have to do NAT. So what I understood from this discussion is that I won't be needing service's IP address for NAT. Instead, I can use the IP address of the node for this purpose? FYI, I have an ingress resource working as a LB as well that takes the request and the forwards it to service that takes it to the relevant pod. So, I can use the IP address of the LB/node for NAT and I don't need to put my cluster's resources inside a specific VLAN that is created in the switch?
b
bland-article-62755
10/12/2023, 6:09 PMYeah I think the AD service will see it coming from the node (or the public IP depending on how things are set up) and not from the service address inside the cluster.
b
bulky-leather-83471
10/12/2023, 6:09 PMAlright. Thanks a lot mate
b
bland-article-62755
10/12/2023, 6:09 PMnp
2 Views