Post

What's been sitting in my Obsidian notes for over a year now, I finally took the time to put it up on my blog. I have a few more blog posts coming up as part of this series. #kubernetes #ipv6 #cilium netops2devops.net/series/kuber...

part1 covers underlying #ipv6 infrastructure requirements before installing #kubernetes netops2devops.net/series/k8s-c...

part2 covers building the simplest #IPv6 only #k3s cluster using @cilium.io netops2devops.net/series/k8s-c...

topics for subsequent posts: - IPv6 address planning to run #cilium in native routing with cluster pool vs. multi-pool ipam. - Cilium BGP control plane with LB IPAM and GatewayAPI for ingress - Predictable egress IP without using an egress gateway (aka no SNAT/masquerading) Stay tuned ;)

Also cover BGP ECMP/Anycast of pods + seperate GUA addressing for unique unicast per node to eliminate the need for GENEVE or other host-to-host tunnelling. Would love to see a single blog post or blog post that covers this end-to-end.

That's just just unicast, right? Or Anycast for global ingress + seperate unicast for pod-to-pod comms or pod-to-WAN comms.

pod to pod and pod to wan is Unicast. Ingress has to be a virtual IP. It’s basically a load balancer for your Pods. Albeit, since Cilium uses Envoy proxy as L7 proxy underneath it preserves the original source IP. So when user traffic reaches pod it sees real source IP

What if my application is SIP server using native SIP (no UDP) or native SCTP? Ideally I'd like to avoid reverse proxy of any kind.

Since pod address are ephemeral there has to be a mechanism that provides a fixed stable address (Gateway address) for the application that an end user can access.