Restrict Kubelet, Kube-proxy, etc to specific network interfaces

1/2/2020

I have a CentOS lab environment that holds 3 systems (A, B, C). Each system has 4 network links:

  • eth0 is 1g and my public management interface (VLAN10)
  • eth1 is 10g my iscsi interface (VLAN172)
  • eth2 is 10g available for kubernetes (VLAN192: 192.168.1.x)
  • eth3 is 10g available for kubernetes (VLAN192: 192.168.2.x)

eth2 and eth3 are not bonded or in any sort of config where they are aware of each other. They are both in the same vlan and you can ping from eth2 to eth3 from any given system.

I'd like to setup Kubernetes to use eth2 and eth3 for all its work. In particular, I want to keep traffic off the slower 1g network and off of the interface I'm using for iscsi. All the kubernetes bits (control plane, data plane, applications, etc) to run over eth2 and eth3.

I may down the road want to open a specific service on eth0 for consumption (prometheus metrics).

Specific Config:

System A:

  • eth0 is my public management interface (VLAN10: 10.10.10.1)
  • eth1 is my iscsi interface (VLAN172: 172.16.0.1)
  • eth2 is available for kubernetes (VLAN192: 192.168.1.1)
  • eth3 is available for kubernetes (VLAN192: 192.168.2.1)

System B:

  • eth0 is my public management interface (VLAN10: 10.10.10.2)
  • eth1 is my iscsi interface (VLAN172: 172.16.0.2)
  • eth2 is available for kubernetes (VLAN192: 192.168.1.2)
  • eth3 is available for kubernetes (VLAN192: 192.168.2.2)

System C:

  • eth0 is my public management interface (VLAN10: 10.10.10.3)
  • eth1 is my iscsi interface (VLAN172: 172.16.0.3)
  • eth2 is available for kubernetes (VLAN192: 192.168.1.3)
  • eth3 is available for kubernetes (VLAN192: 192.168.2.3)

The default setup with kubeadm init seems to use all interfaces.

I can't seem to find any documentation to guide me....

-- jcpunk
cni
kubernetes

1 Answer

1/2/2020

As mentioned in the docs here https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init/

use the flag --apiserver-advertise-address

ie kubeadm init --apiserver-advertise-address 192.168.1.1

-- Tummala Dhanvi
Source: StackOverflow