Accessing Kubernetes services from external world

1. Kubernetes External
Access
Neependra Khare, CloudYuga
@neependra

2. Load Balancing Basics
LB
Server2Server1
Server
N

3. Load Balancing Basics
• Layer 7 LB - HTTP
• Layer 4 LB - TCP/UDP

4. Load Balancing in K8s
• Internal
• Kube-proxy
• External
• Cloud LoadBalancer
• NodePort
• External IP
• Ingress
• Service LBs

5. Kube-proxy
kube-proxy kube-proxy
kube-proxy
PodA PodA
Requestto
access
service
forPodA
Worker Worker Worker

6. External - Cloud LB
kube-proxy kube-proxy kube-proxy
Cloud LB
PodA PodB
PodA
PodB
Worker Worker Worker

7. External - NodePort
• ` kube-proxy kube-proxy kube-proxy
PodA PodB
PodA
PodB
NodePort-2 NodePort-2NodePort-2NodePort1 NodePort1NodePort1
Worker Worker Worker

8. External - Cloud LB
kube-proxy kube-proxy kube-proxy
Cloud LB
PodA PodB
PodA
PodB
NodePort-2 NodePort-2NodePort-2NodePort1 NodePort1NodePort1
WorkerWorkerWorker
external IPexternal IP

9. External - External IP
kube-proxy kube-proxy kube-proxy
PodA PodB
PodA
PodB
808080 808080
External IP
Worker Worker Worker

10. External - Ingress
Ingress
Resources
LBIngress
Controller
watches updates

11. External - Ingress (GKE)
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: test
spec:
rules:
- host: foo.bar.com
http:
paths:
- path: /foo
backend:
serviceName: s1
servicePort: 80
- path: /bar
backend:
serviceName: s2
servicePort: 80
LB1 LB2
PodA PodA
PodB
PodB
PodB
PodC PodC
/foo
/bar
/xyz
foo.bar.com bar.xyz.com
Worker Worker
NodePort1
NodePort-2 NodePort-3

12. External - Ingress (GKE)
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: test
spec:
rules:
- host: foo.bar.com
http:
paths:
- backend:
serviceName: s1
servicePort: 80
- host: bar.foo.com
http:
paths:
- backend:
serviceName: s2
servicePort: 80
LB1 LB2
PodA PodA
PodB
PodB
PodB
PodC PodC
foo.bar.com
bar.foo.com
abc.xyz.com
Worker Worker
NodePort1
NodePort-2 NodePort-3

13. External - Ingress (Nginx)
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: test
spec:
rules:
- host: foo.bar.com
http:
paths:
- path: /foo
backend:
serviceName: s1
servicePort: 80
- path: /bar
backend:
serviceName: s2
servicePort: 80
LB1 LB2
PodA PodA
PodB
PodB
PodB
PodC PodC
/foo
/bar
/xyz
foo.bar.com bar.xyz.com
Worker Worker

14. Service LB
LB
HAProxy
apiVersion: v1
kind: ReplicationController
metadata:
name: service-loadbalancer
labels:
app: service-loadbalancer
version: v1
spec:
replicas: 1
selector:
app: service-loadbalancer
version: v1
template:
metadata:
labels:
app: service-loadbalancer
version: v1
spec:
nodeSelector:
role: loadbalancer
containers:
- image: gcr.io/google_containers/servicelb:0.4
imagePullPolicy: Always
livenessProbe:
httpGet:
path: /healthz
port: 8081
scheme: HTTP
initialDelaySeconds: 30
timeoutSeconds: 5
name: haproxy
ports:
# All http services
- containerPort: 80
hostPort: 80
protocol: TCP
# mysql
- containerPort: 3306
hostPort: 3306
protocol: TCP
# haproxy stats
- containerPort: 1936
https://github.com/kubernetes/contrib/blob/m
PodB
PodA
PodB
Worker Worker

15. Q & A
Thanks
@neependra, CloudYuga.guru