HTTP calls from inside the cluster not using the External IP assigned

1/30/2017

I have a Kubernetes Service with a static External IP assigned to a Replication Controller managing 1 application distributed to 2 Pods. I can access the application using the external IP, this part works fine.

I'd like now to have the application inside the Pods using the same IP when making HTTP requests to external applications (outside the cluster).

A simple call to https://api.ipify.org/ shows that the IP of this application is completely different from the external IP it answers at. How can I make it use the same IP?

-- cahen
google-kubernetes-engine
kubernetes

2 Answers

1/30/2017

according to the documentation the externalIP assignment for a Service is just meant for ingress traffic. Along with that the somewhat related Integrating External Services documentation from OpenShift doesn't mention any options to proxy the egress traffic through the defined Endpoint. Therefore it seems that you're trying something which doesn't work with Kubernetes out of the box.

-- pagid
Source: StackOverflow

1/31/2017

Theshort and simple answer is - you can't. Your pods are assigned IPs that are internal to your cluster, most likely from a per node range of particular cluster wide network address space. When talking to external world, pods traffic originates on an internally bridged interface/IP and if the destination is not part of the cluster it leaves by means of particular node default route, ending in being SNATed to the node IP, or to the IP of the NAT gateway if your traffic goes through such.

Even if you were to create custom SNAT rules for pods by means of some k8s watching etc. (much like ingress controller), the traffic would still bounce off of loadbalancer rather then reach your pods.

If you need a maintained IP address, what you can do, is pass your pods traffic via NAT gateway and make sure it NATs as you expect (this would not give you the same IP as your service, just a "stable" one), or make traffic like http requests go via PROXY with a stable IP(s).

All in all, while to some extent possible, it's unlikely to be worth the headache of setting it up.

-- Radek 'Goblin' Pieczonka
Source: StackOverflow