Pattern 6: Cloud Pod ↔ Hybrid Pod (East-West)

Pattern 6: Cloud Pod ↔ Hybrid Pod (East-West) An architecture diagram generated by Archify. Cloud Pod · 10.0.0.56 · VPC CNI · AWS · Cluster VPC 10.0.0.0/16 › EC2 Node 10.0.0.22 Cloud Pod 10.0.0.56 · VPC CNI ENI · EC2 Node 10.0.0.22 · AWS · Cluster VPC 10.0.0.0/16 › EC2 Node 10.0.0.22 ENI EC2 Node 10.0.0.22 VPC Router · VPC route table · AWS · Cluster VPC 10.0.0.0/16 VPC Router VPC route table Gateway · VPN / Direct Connect · Architecture component Gateway VPN / Direct Connect On-prem Router · On-prem route table · On-premises · Node CIDR 10.80.0.0/16 · Pod CIDR 10.85.0.0/16 On-prem Router On-prem route table Hybrid Node 10.80.0.3 · Pod CIDR 10.85.2.0/24 · On-premises · Node CIDR 10.80.0.0/16 · Pod CIDR 10.85.0.0/16 Hybrid Node 10.80.0.3 Pod CIDR 10.85.2.0/24 iptables · kube-proxy rules · On-premises · Node CIDR 10.80.0.0/16 · Pod CIDR 10.85.0.0/16 › Hybrid Node 10.80.0.2 · Pod CIDR 10.85.1.0/24 iptables kube-proxy rules CNI · Cilium · On-premises · Node CIDR 10.80.0.0/16 · Pod CIDR 10.85.0.0/16 › Hybrid Node 10.80.0.2 · Pod CIDR 10.85.1.0/24 CNI Cilium Hybrid Pod · 10.85.1.56 · On-premises · Node CIDR 10.80.0.0/16 · Pod CIDR 10.85.0.0/16 › Hybrid Node 10.80.0.2 · Pod CIDR 10.85.1.0/24 Hybrid Pod 10.85.1.56 1 · send to 10.85.1.56 2 · VPC routing 3 · 10.85.0.0/16 static 4 · cross the boundary 5 · 10.85.1.0/24 via 10.80.0.2 6 · deliver to pod 10.85.2.0/24 via 10.80.0.3 AWS · Cluster VPC 10.0.0.0/16 EC2 Node 10.0.0.22 On-premises · Node CIDR 10.80.0.0/16 · Pod CIDR 10.85.0.0/16 Hybrid Node 10.80.0.2 · Pod CIDR 10.85.1.0/24 Legend Backend Cloud Security External

VPC route table

  • • 10.0.0.0/16 [local]
  • • 10.80.0.0/16 [static] via Gateway
  • • 10.85.0.0/16 [static] via Gateway

On-prem route table

  • • 10.80.0.0/16 [local] via eth0
  • • 10.0.0.0/16 [static] via Gateway
  • • 10.85.1.0/24 [dynamic] via 10.80.0.2
  • • 10.85.2.0/24 [dynamic] via 10.80.0.3

Requirements

  • • Routable pod CIDR (10.85.0.0/16)
  • • VPC route table entries for the on-prem node and pod CIDRs
  • • Hybrid Pod → Cloud Pod takes the same path in reverse (10.0.0.0/16 static via Gateway)