Remote Pod CIDRs on Hybrid Nodes

Remote Pod CIDRs on Hybrid Nodes An architecture diagram generated by Archify. Hybrid node 10.80.0.2 · Pod CIDR 10.85.1.0/24 · CNI · Remote Node CIDR 10.80.0.0/16 · Remote Pod CIDR 10.85.0.0/16 Hybrid node 10.80.0.2 Pod CIDR 10.85.1.0/24 · CNI Hybrid node 10.80.0.3 · Pod CIDR 10.85.2.0/24 · CNI · Remote Node CIDR 10.80.0.0/16 · Remote Pod CIDR 10.85.0.0/16 Hybrid node 10.80.0.3 Pod CIDR 10.85.2.0/24 · CNI On-prem router · Routing table · Architecture component On-prem router Routing table Gateway · On-prem ↔ AWS link · VPC 10.0.0.0/16 · Architecture component Gateway On-prem ↔ AWS link · VPC 10.0.0.0/16 advertises pod CIDR advertises pod CIDR carries VPC range Remote Node CIDR 10.80.0.0/16 · Remote Pod CIDR 10.85.0.0/16 Legend Backend Cloud

Pod CIDR per node

  • • Each hybrid node receives a slice of the Remote Pod CIDR
  • • Node 10.80.0.2 uses 10.85.1.0/24 and node 10.80.0.3 uses 10.85.2.0/24
  • • The CNI on the node allocates pod IPs from that range (10.85.1.10, 10.85.1.11, and so on)

What the router must know

  • • The on-prem router has to know which pod CIDR sits on which node
  • • Three mechanisms convey that: static routes, BGP, and ARP proxy
  • • Without it, traffic addressed to a pod IP never arrives

Toward AWS

  • • The gateway owns the route toward the VPC range (10.0.0.0/16)
  • • In the other direction, the VPC route table needs routes for the remote node and pod ranges
  • • Pod-to-VPC traffic works only when both directions are routed