undefined | Better HN

0 pointsraesene98y ago0 comments

In my experience NAT is almost always involved in a Kubernetes setup (for on-prem).

The container network is generally not routable to the wider corporate WAN (it'll use RFC1918 addresses by default). You typically get one set of addresses for the main container network, a different set of addresses for the service IPs and then an routable set on the ingress.

0 comments

zaat8y ago

What you describe is not NAT, the containers network segment is a separate network segment which is not accessible from outside the cluster, not directly and not through address translation. The ingress and service addresses are externally reachable addresses that expose services. NAT is not required for the setup.

raesene9OP8y ago

If traffic flows from the pod network to an external network NAT is involved, as the Pod network is not routable.

puzzle8y ago

I can see how it's more likely on prem, but at my job, we run Kubernetes in production on AWS and most traffic is pod to pod, without NAT involved.

j / k navigate · click thread line to collapse