Networking

📅Published 2026-08-25·⏱1 min read

This section covers networking, the biggest hurdle in hybrid cluster adoption. It is organized in practical order, from IP address range design to building and operating the Hybrid Nodes Gateway, and writing pre-registration requests to submit to firewall and network teams.

---

🗺️

CIDR Design and Address-Range Minimization

Determining routing requirements, rationale for minimal VPC sizing, dedicated subnets for control plane ENIs, proactively reserving Pod CIDRs, dev/stg/prd address planning

🔀

CNI Configuration and Pod CIDR Routing

Cilium (AWS-supported CNI) selection criteria, hybrid affinity and cluster-pool IPAM, BGP Control Plane vs static routing configuration

🚇

Building and Operating the Hybrid Nodes Gateway

Cilium VTEP configuration, Helm installation, instance sizing (vertical scaling), 3–5 second failover HA model, monitoring, removal caveats

⚖️

Load Balancing and Service Exposure

Traffic-origin-based NLB vs Cilium built-in LB decision principle, AWS Load Balancer Controller IP targets, LB IPAM and BGP advertisement, MetalLB

🧱

Firewall Pre-Registration & TGW Topology

5-zone firewall rule table (request-form level), handling lack of FQDN wildcard support, TGW route design, on-premises LB → cloud Pod path