Networking
3 min read
This section covers networking, the biggest hurdle in hybrid cluster adoption. It is organized in practical order, from IP address range design to building and operating the Hybrid Nodes Gateway, and writing pre-registration requests to submit to firewall and network teams.
CIDR Design and Address-Range MinimizationDetermining routing requirements, rationale for minimal VPC sizing, dedicated subnets for control plane ENIs, proactively reserving Pod CIDRs, dev/stg/prd address planningCNI Configuration and Pod CIDR RoutingCilium (AWS-supported CNI) selection criteria, hybrid affinity and cluster-pool IPAM, BGP Control Plane vs static routing configurationBuilding and Operating the Hybrid Nodes GatewayCilium VTEP configuration, Helm installation, instance sizing (vertical scaling), 3–5 second failover HA model, monitoring, removal caveatsLoad Balancing and Service ExposureTraffic-origin-based NLB vs Cilium built-in LB decision principle, AWS Load Balancer Controller IP targets, LB IPAM and BGP advertisement, MetalLBFirewall Pre-Registration & TGW Topology5-zone firewall rule table (request-form level), handling lack of FQDN wildcard support, TGW route design, on-premises LB → cloud Pod pathPrivate Air-gapped VPC Endpoint DesignPrivate-only Kubernetes API, feature-specific PrivateLink, on-premises ECR and S3 interface paths, DNS, return routing, and installation mirrors