Answering for Pod IPs with ARP Proxy

Answering for Pod IPs with ARP Proxy An architecture diagram generated by Archify. Hybrid node 10.80.0.2 · Pod CIDR 10.85.1.0/24 · CNI · Remote Node CIDR 10.80.0.0/16 · Remote Pod CIDR 10.85.0.0/16 Hybrid node 10.80.0.2 Pod CIDR 10.85.1.0/24 · CNI Hybrid node 10.80.0.3 · Pod CIDR 10.85.2.0/24 · CNI · Remote Node CIDR 10.80.0.0/16 · Remote Pod CIDR 10.85.0.0/16 Hybrid node 10.80.0.3 Pod CIDR 10.85.2.0/24 · CNI On-prem router · Routing table · Architecture component On-prem router Routing table Gateway · On-prem ↔ AWS link · VPC 10.0.0.0/16 · Architecture component Gateway On-prem ↔ AWS link · VPC 10.0.0.0/16 ARP REPLY (Node 1 MAC) ARP REPLY (Node 2 MAC) 10.0.0.0/16 static Remote Node CIDR 10.80.0.0/16 · Remote Pod CIDR 10.85.0.0/16 Legend Backend Cloud

How ARP proxy works

  • • The router sends an ARP REQUEST asking for the MAC of a pod IP (10.85.1.10)
  • • The node hosting that pod answers with an ARP REPLY carrying its own MAC
  • • The router then treats the pod IP as a host on the same link

Router routing table

  • • 10.80.0.0/16 [local] via eth0 (CONNECTED)
  • • 10.85.1.10/32 · 10.85.1.11/32 · 10.85.2.10/32 [local] via eth0 (CONNECTED)
  • • 10.0.0.0/16 [static] via Gateway (STATIC)

Strengths and limits

  • • No route configuration on the router, so it needs the least coordination with the network team
  • • Every pod produces a /32 host route, so the ARP table grows with pod count
  • • The node's CNI must support ARP proxy and the subnet must be one broadcast domain