I have created 2 kubernetes clusters on AWS within a VPC.

1) Cluster dedicated to micro services (MI) 2) Cluster dedicated to Consul/Vault (Vault) So basically both of those clusters can be reached through distinct classic public load balancers which expose k8s APIs

MI: https://api.k8s.domain.com Vault: https://api.vault.domain.com

I also set up openvpn on both clusters, so you need to be logged in vpn to "curl" or "kubectl" into the clusters. To do that I just added a new rule in the ELBs's security groups with the VPN's IP on port 443:

HTTPS 443 VPN's IP/32

At this point all works correctly, which means I'm able to successfully "kubectl" in both clusters.

Next thing I need to do, is to be able to do a curl from Vault's cluster within pod's container within into the MI cluster. Basically:

Vault Cluster --------> curl https://api.k8s.domain.com --header "Authorization: Bearer $TOKEN"--------> MI cluster

The problem is that at the moment clusters only allow traffic from VPN's IP.

To solve that, I've added new rules in the security group of MI cluster's load balancer.

Those new rules allow traffic from each vault's node private and master instances IPs. But for some reason it does not work!

Please note that before adding restrictions in the ELB's security group I've made sure the communication works with both clusters allowing all traffic (0.0.0.0/0)

So the question is when I execute a command curl in pod's container into another cluster api within the same VPC, what is the IP of the container to add to the security group ?