Skip to main content

Cluster Networking

Cluster networking encompasses the configuration and management of Container Network Interface (CNI) plugins, CIDR range management, and integration with vCloud infrastructure for Kubernetes clusters.

Network Configuration Overview​

Cluster Network Architecture​

Kubernetes clusters use multiple network layers:

  • Node Network: Physical/virtual network connectivity between cluster nodes
  • Pod Network: Container networking managed by CNI plugins
  • Service Network: Internal service discovery and load balancing
  • Ingress Network: External access to cluster services

![Figure needed]

Diagram showing cluster network architecture layers

Current Network Configuration Display​

In the cluster overview, network configuration is displayed in the networking panel:

![Figure needed]

Screenshot of cluster overview networking panel

Displayed Information​

  • Network CNI: Container Network Interface plugin type (e.g., "Calico")
  • Pod CIDR: Pod network address range (e.g., "10.244.0.0/16")
  • Service CIDR: Service network address range (e.g., "10.96.0.0/12")

CNI Plugin Configuration​

Available CNI Plugins​

  • Full-featured Networking: Comprehensive network policy support
  • Security: Built-in network security policies
  • Performance: High-performance networking
  • Scalability: Scales to large cluster deployments
  • Features: Network policies, encryption, advanced routing

![Figure needed]

Screenshot showing Calico CNI configuration

Plugin Capabilities​

  • Network Policies: Fine-grained traffic control between pods
  • Encryption: Optional pod-to-pod encryption
  • IP Management: Automatic IP address management
  • Route Management: Automatic route configuration
  • Load Balancing: Built-in load balancing capabilities

CNI Plugin Selection​

Currently, CNI plugin selection occurs during cluster creation:

  • Default Selection: Calico is the recommended default
  • Configuration: CNI selection in cluster creation wizard
  • Post-deployment: CNI changes require cluster recreation
  • Compatibility: Ensure workload compatibility with selected CNI

CIDR Range Management​

Pod Network CIDR​

Default Configuration​

  • Default Range: 10.244.0.0/16
  • Address Space: Provides ~65,000 IP addresses for pods
  • Subnet Allocation: Automatically divided among cluster nodes
  • Growth Capacity: Sufficient for most cluster deployments

![Figure needed]

Screenshot of pod CIDR configuration in cluster creation

Planning Considerations​

Pod CIDR Sizing Guidelines:
- Small Clusters (under 50 nodes): /20 or /16 sufficient
- Medium Clusters (50-200 nodes): /16 recommended
- Large Clusters (200 or more nodes): /14 or larger
- Multi-cluster: Ensure non-overlapping ranges

Conflict Prevention​

  • Existing Networks: Ensure no overlap with VPC networks
  • Service CIDR: Must not overlap with service network
  • External Networks: Avoid conflicts with external networks
  • Future Growth: Plan for potential network expansion

Service Network CIDR​

Default Configuration​

  • Default Range: 10.96.0.0/12
  • Address Space: Provides ~1 million IP addresses for services
  • Internal Use: Used only for internal service discovery
  • Automatic Management: Kubernetes manages service IP allocation

Service Network Planning​

Service CIDR Considerations:
- Size: /12 provides ample space for most deployments
- Isolation: Separate from pod and node networks
- Internal Only: Not routable outside cluster
- DNS Integration: Integrates with cluster DNS

vCloud Integration​

Network Interface Integration​

VPC Network Selection​

During cluster creation, you select from available VPC networks:

  • Available Networks: List of configured VPC network interfaces
  • Compatibility Check: Automatic verification of network compatibility
  • IP Allocation: Sufficient IP addresses verified for cluster size
  • Security Groups: Automatic application of appropriate security groups

![Figure needed]

Screenshot of network selection during cluster creation

Network Requirements​

  • Node Connectivity: Each cluster node requires a network interface
  • IP Availability: Sufficient IP addresses for all cluster nodes
  • Security Access: Appropriate security group configurations
  • Zone Coverage: Network availability in selected availability zones

Security Group Integration​

Automatic Port Configuration​

The system automatically configures required ports for Kubernetes:

Essential Kubernetes Ports:
- 6443: Kubernetes API server
- 2379-2380: etcd cluster communication
- 10250: kubelet API
- 10259: kube-scheduler
- 10257: kube-controller-manager
- 80/443: Ingress traffic (when enabled)

Security Group Management​

  • Automatic Application: Security groups applied to all cluster nodes
  • Port Management: Required ports opened automatically
  • Custom Rules: Additional rules can be configured through vCloud
  • Updates: Security group updates applied to existing clusters

Resource Group Association​

Network Placement​

  • Resource Group: Networks associated with specific vCloud resource groups
  • Zone Alignment: Networks and clusters in same availability zones
  • Resource Limits: Network usage counts against resource group quotas
  • Performance: Optimized placement for network performance

Network Configuration Examples​

Standard Cluster Configuration​

# Example cluster network configuration
cluster:
  networking:
    cni: "calico"
    podCIDR: "10.244.0.0/16"
    serviceCIDR: "10.96.0.0/12"
    dnsdom: "cluster.local"
  
  infrastructure:
    vpcNetwork: "vpc-production-1"
    securityGroups: ["kubernetes-cluster"]
    zones: ["zone-a", "zone-b"]

Multi-cluster Network Planning​

# Example multi-cluster CIDR planning
cluster1:
  podCIDR: "10.244.0.0/16"    # First cluster
  serviceCIDR: "10.96.0.0/12"

cluster2:
  podCIDR: "10.245.0.0/16"    # Second cluster (non-overlapping)
  serviceCIDR: "10.97.0.0/12"

cluster3:
  podCIDR: "10.246.0.0/16"    # Third cluster (non-overlapping)
  serviceCIDR: "10.98.0.0/12"

Network Policy Implementation​

Kubernetes Network Policies​

Policy Types​

  • Ingress Policies: Control inbound traffic to pods
  • Egress Policies: Control outbound traffic from pods
  • Namespace Isolation: Isolate traffic between namespaces
  • Pod Selectors: Fine-grained pod-level traffic control

Example Network Policy​

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

CNI Plugin Policy Support​

  • Calico: Full network policy implementation
  • Policy Enforcement: Automatic policy enforcement at node level
  • Default Policies: Configurable default allow/deny behaviors
  • Advanced Features: Support for advanced policy features

DNS Configuration​

Cluster DNS​

DNS Service​

  • CoreDNS: Default DNS service for name resolution
  • Service Discovery: Automatic service name resolution
  • External DNS: Resolution of external domain names
  • Custom Configuration: Customizable DNS configurations

DNS Domain Configuration​

  • Default Domain: cluster.local
  • Service Names: Services accessible via DNS names
  • Pod DNS: DNS configuration for individual pods
  • External Integration: Integration with external DNS systems

Performance Optimization​

Network Performance Tuning​

CNI Optimization​

  • Plugin Selection: Choose appropriate CNI for workload requirements
  • Configuration Tuning: Optimize CNI plugin configurations
  • Performance Monitoring: Monitor network performance metrics
  • Bottleneck Identification: Identify and resolve network bottlenecks

Traffic Optimization​

  • Load Distribution: Distribute network traffic across nodes
  • Service Mesh: Consider service mesh for advanced traffic management
  • Caching: Implement appropriate caching strategies
  • CDN Integration: Use CDN for external traffic optimization

Monitoring and Analytics​

  • Network Metrics: Monitor network performance metrics
  • Traffic Analysis: Analyze network traffic patterns
  • Capacity Planning: Plan for network capacity growth
  • Cost Optimization: Optimize network costs

Best Practices​

Planning​

  1. CIDR Planning: Carefully plan CIDR ranges to avoid conflicts
  2. Network Sizing: Size networks appropriately for expected growth
  3. Security Planning: Plan security group and network policy requirements
  4. Performance Requirements: Consider performance requirements early

Implementation​

  1. CNI Selection: Choose CNI plugin based on requirements
  2. Security Groups: Configure appropriate security group rules
  3. Network Policies: Implement network policies for traffic control
  4. Monitoring: Set up comprehensive network monitoring

Operations​

  1. Regular Monitoring: Monitor network performance and health
  2. Capacity Management: Manage network capacity and growth
  3. Security Updates: Keep security configurations updated
  4. Documentation: Maintain network configuration documentation

Next: Learn about Ingress Management for external access configuration.