Cilium: Up and Running

Chapter 10. Cluster Access

Accessing applications inside a Kubernetes cluster from the outside world is a common requirement. An external client, whether it’s a user’s laptop, an upstream router, or another application, needs a stable way to reach a service inside the cluster.

In Chapter 7, we introduced Cilium’s support for Kubernetes Ingress and Gateway API as mechanisms to load-balance and manipulate traffic once it reaches the cluster. However, we have not yet explained how external clients become aware of the cluster’s external-facing IP address. That is the focus of this chapter.

The most straightforward option provided by Kubernetes is a service of type NodePort. With a NodePort service, Kubernetes opens the same port number on every node in the cluster and forwards traffic from that port to the service’s backend pods. This works without additional setup and is often used in simple clusters where clients know the node IPs directly.

NodePort introduces two layers of selection. At the first layer, the client chooses which node to contact. At the second layer, the node that receives the traffic forwards it to one of the healthy backend pods, as explained in Chapter 6. The second layer works consistently because Kubernetes tracks pod health and removes failing backends. The first layer is where problems appear.

If the client chooses a node that later becomes unavailable, there is no mechanism in Kubernetes that automatically redirects the connection to another node. The client ...