Network setting

K3s will come with pretty much everything pre-configured like traefik.

More info about traefik: https://doc.traefik.io/traefik/

However, I would like to have LoadBalancer, and in essence to be able to give services (pods) an external IP, just like my Kubernetes nodes, not from internal Kubernetes ranges. Normally, this is an external component, and your cloud provider should somehow magically give that to you, but since we are our own cloud provider, and we are trying to keep everything in one cluster... in short MetalLB is the answer.

What is MetalLB

https://metallb.universe.tf/

Deployment

This is a two-step process: we deploy MetalLB load balancer, and then push configuration to it, and tell it what range of IPs to use.

Apply the following: first we will create a namespace called metallb-system, and second we will deploy MetalLB into it.

kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.12.1/manifests/namespace.yaml
kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.12.1/manifests/metallb.yaml

We need to create a secret key for the speakers (the MetalLB pods) to encrypt speaker communications:

kubectl create secret generic -n metallb-system memberlist --from-literal=secretkey="$(openssl rand -base64 128)"

This key is just for internal use, and you don't need to worry about it.

Configuration

Next, create config.yaml in your MetalLB folder; here we are going to tell MetalLB what IPs to use:

apiVersion: v1
kind: ConfigMap
metadata:
  namespace: metallb-system
  name: config
data:
  config: |
    address-pools:
    - name: default
      protocol: layer2
      addresses:
      - 192.168.0.200-192.168.0.250

As you can see, I specified a range from 192.168.0.200 to 192.168.0.250. That will give me 50 "external" IPs to work with for now.

Apply the config:

kubectl apply -f config.yaml

You can always go back and change the IP range if you want, and apply the config again.

Check

Check if everything deployed OK

root@control01:~/metallb# kubectl get pods -n metallb-system
NAME                         READY   STATUS    RESTARTS   AGE
controller-57fd9c5bb-rdl7v   1/1     Running   0          5m42s
speaker-h7chj                1/1     Running   0          5m42s
speaker-pg7kp                1/1     Running   0          5m42s
speaker-78pdz                1/1     Running   0          5m42s
speaker-ghpxz                1/1     Running   0          5m42s
speaker-8cf7k                1/1     Running   0          5m42s
speaker-2t6jp                1/1     Running   0          5m42s
speaker-cjcpn                1/1     Running   0          5m41s
speaker-mv7v4                1/1     Running   0          5m42s

You should have as many speaker-xxxx as you have nodes in the cluster, since they run one per node.

Now services that use LoadBalancer should have an external IP assigned to them.

For example:

root@control01:~/metallb# kubectl get svc --all-namespaces
NAMESPACE     NAME             TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                      AGE
default       kubernetes       ClusterIP      10.43.0.1       <none>          443/TCP                      12m
kube-system   kube-dns         ClusterIP      10.43.0.10      <none>          53/UDP,53/TCP,9153/TCP       12m
kube-system   metrics-server   ClusterIP      10.43.254.144   <none>          443/TCP                      12m
kube-system   traefik          LoadBalancer   10.43.159.145   192.168.0.200   80:31225/TCP,443:32132/TCP   10m

Look how traefik automatically got an IP from the external range. In the end, this is what you would want: Not to point to a single node IP and be redirected based on DNS, which would stop working the moment the node with that IP died. This way, we make the external IP node independent. Now, you can point DNS to that IP and be sure it will be routed correctly.

Comments