Kubernetes cluster in public and private topology
I am trying to setup a kubernetes cluster in aws using Kops. But i have requirement like deploy the master nodes in public subnet and some workers in public and some workers in private subnet.
I need the network something like below:
So, is it possible to create this network using kops?
amazon-web-services
kubernetes kops asked Nov 21 '18 at 6:55
Naveen KeratiNaveen Kerati
391317
add a comment |
I am trying to setup a kubernetes cluster in aws using Kops. But i have requirement like deploy the master nodes in public subnet and some workers in public and some workers in private subnet.
I need the network something like below:
So, is it possible to create this network using kops?
amazon-web-services
kubernetes kops asked Nov 21 '18 at 6:55
Naveen KeratiNaveen Kerati
391317
what scenario are you trying to implement?
– Ohmen
Nov 22 '18 at 10:52
@Ohmen I have frontend applications that should be available over public and applications that should run as jobs in private subnets.
– Naveen Kerati
Nov 22 '18 at 11:13
add a comment |
I am trying to setup a kubernetes cluster in aws using Kops. But i have requirement like deploy the master nodes in public subnet and some workers in public and some workers in private subnet.
I need the network something like below:
So, is it possible to create this network using kops?
amazon-web-services
kubernetes kops asked Nov 21 '18 at 6:55
Naveen KeratiNaveen Kerati
391317
I am trying to setup a kubernetes cluster in aws using Kops. But i have requirement like deploy the master nodes in public subnet and some workers in public and some workers in private subnet.
I need the network something like below:
So, is it possible to create this network using kops?
amazon-web-services
kubernetes kops amazon-web-services
kubernetes kops asked Nov 21 '18 at 6:55
Naveen KeratiNaveen Kerati
391317
asked Nov 21 '18 at 6:55
Naveen KeratiNaveen Kerati
391317
asked Nov 21 '18 at 6:55
Naveen KeratiNaveen Kerati
391317
asked Nov 21 '18 at 6:55
Naveen KeratiNaveen Kerati
391317
asked Nov 21 '18 at 6:55
Naveen KeratiNaveen Kerati
391317
391317
what scenario are you trying to implement?
– Ohmen
Nov 22 '18 at 10:52
@Ohmen I have frontend applications that should be available over public and applications that should run as jobs in private subnets.
– Naveen Kerati
Nov 22 '18 at 11:13
add a comment |
what scenario are you trying to implement?
– Ohmen
Nov 22 '18 at 10:52
@Ohmen I have frontend applications that should be available over public and applications that should run as jobs in private subnets.
– Naveen Kerati
Nov 22 '18 at 11:13
what scenario are you trying to implement?
– Ohmen
Nov 22 '18 at 10:52
what scenario are you trying to implement?
– Ohmen
Nov 22 '18 at 10:52
@Ohmen I have frontend applications that should be available over public and applications that should run as jobs in private subnets.
– Naveen Kerati
Nov 22 '18 at 11:13
@Ohmen I have frontend applications that should be available over public and applications that should run as jobs in private subnets.
– Naveen Kerati
Nov 22 '18 at 11:13
add a comment |
1 Answer
1
active
oldest
votes
Kubernetes nodes should never be directly connected to the internet.
I assume you want to expose services via NodePort which is in general a bad idea. Because NodePort service are exposed on ALL nodes not just the ones where the pods are running.
You should place all nodes and masters in private Subnets and manage the external Access via elastic load balancers and ingress. This way you can explicitly expose frontend services to the internet.
The relevant kops-spec.yaml snippet would be:
topology:
dns:
type: Public
masters: private
nodes: private
answered Nov 22 '18 at 12:13
OhmenOhmen
2,34321725
okay thanks, Ohmen.
– Naveen Kerati
Nov 23 '18 at 6:28
you are welcome. Please accept the anwer if it solved your problem
– Ohmen
Nov 23 '18 at 12:51
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53406714%2fkubernetes-cluster-in-public-and-private-topology%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Kubernetes nodes should never be directly connected to the internet.
I assume you want to expose services via NodePort which is in general a bad idea. Because NodePort service are exposed on ALL nodes not just the ones where the pods are running.
You should place all nodes and masters in private Subnets and manage the external Access via elastic load balancers and ingress. This way you can explicitly expose frontend services to the internet.
The relevant kops-spec.yaml snippet would be:
topology:
dns:
type: Public
masters: private
nodes: private
answered Nov 22 '18 at 12:13
OhmenOhmen
2,34321725
okay thanks, Ohmen.
– Naveen Kerati
Nov 23 '18 at 6:28
you are welcome. Please accept the anwer if it solved your problem
– Ohmen
Nov 23 '18 at 12:51
add a comment |
Kubernetes nodes should never be directly connected to the internet.
I assume you want to expose services via NodePort which is in general a bad idea. Because NodePort service are exposed on ALL nodes not just the ones where the pods are running.
You should place all nodes and masters in private Subnets and manage the external Access via elastic load balancers and ingress. This way you can explicitly expose frontend services to the internet.
The relevant kops-spec.yaml snippet would be:
topology:
dns:
type: Public
masters: private
nodes: private
answered Nov 22 '18 at 12:13
OhmenOhmen
2,34321725
okay thanks, Ohmen.
– Naveen Kerati
Nov 23 '18 at 6:28
you are welcome. Please accept the anwer if it solved your problem
– Ohmen
Nov 23 '18 at 12:51
add a comment |
Kubernetes nodes should never be directly connected to the internet.
I assume you want to expose services via NodePort which is in general a bad idea. Because NodePort service are exposed on ALL nodes not just the ones where the pods are running.
You should place all nodes and masters in private Subnets and manage the external Access via elastic load balancers and ingress. This way you can explicitly expose frontend services to the internet.
The relevant kops-spec.yaml snippet would be:
topology:
dns:
type: Public
masters: private
nodes: private
answered Nov 22 '18 at 12:13
OhmenOhmen
2,34321725
Kubernetes nodes should never be directly connected to the internet.
I assume you want to expose services via NodePort which is in general a bad idea. Because NodePort service are exposed on ALL nodes not just the ones where the pods are running.
You should place all nodes and masters in private Subnets and manage the external Access via elastic load balancers and ingress. This way you can explicitly expose frontend services to the internet.
The relevant kops-spec.yaml snippet would be:
topology:
dns:
type: Public
masters: private
nodes: private
answered Nov 22 '18 at 12:13
OhmenOhmen
2,34321725
answered Nov 22 '18 at 12:13
OhmenOhmen
2,34321725
answered Nov 22 '18 at 12:13
OhmenOhmen
2,34321725
answered Nov 22 '18 at 12:13
OhmenOhmen
2,34321725
2,34321725
okay thanks, Ohmen.
– Naveen Kerati
Nov 23 '18 at 6:28
you are welcome. Please accept the anwer if it solved your problem
– Ohmen
Nov 23 '18 at 12:51
add a comment |
okay thanks, Ohmen.
– Naveen Kerati
Nov 23 '18 at 6:28
you are welcome. Please accept the anwer if it solved your problem
– Ohmen
Nov 23 '18 at 12:51
okay thanks, Ohmen.
– Naveen Kerati
Nov 23 '18 at 6:28
okay thanks, Ohmen.
– Naveen Kerati
Nov 23 '18 at 6:28
you are welcome. Please accept the anwer if it solved your problem
– Ohmen
Nov 23 '18 at 12:51
you are welcome. Please accept the anwer if it solved your problem
– Ohmen
Nov 23 '18 at 12:51
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53406714%2fkubernetes-cluster-in-public-and-private-topology%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
what scenario are you trying to implement?
– Ohmen
Nov 22 '18 at 10:52
@Ohmen I have frontend applications that should be available over public and applications that should run as jobs in private subnets.
– Naveen Kerati
Nov 22 '18 at 11:13