Multiple network east-west routing
1. Multiple network east-west routing
In addition to running multiple clusters on the same network, another common configuration is running multiple clusters on different networks. When deploying clusters in multi-cloud or hybrid environments, you might need to enable communication between them without relying on VPNs. Let's explore how to achieve this. When VPC pairing or Cloud Interconnect are not feasible for connecting GKE clusters across different VPC networks, an east-west gateway can be used to facilitate communication. This gateway acts as a proxy, enabling controlled communication between services in different clusters. It's important to understand that the east-west gateway is designed to manage intercluster traffic, particularly in scenarios where direct VPC peering or interconnect is not an option. For each service intended to be accessible across clusters, you configure the gateway accordingly. This allows for a controlled visibility into cross-cluster service communication. Although the gateway is publicly accessible, services can only be accessed by services with a trusted MTLS certificate and workload ID. Production systems may require additional access restrictions, like firewall rules, to prevent external attacks. In this example, a mesh spans across a GKE cluster and an attached cluster running in a customer's location. Attached clusters are GKE compatible, not managed by Google, and must be registered to GKE. Examples of attached clusters include Amazon EKS, Microsoft AKS, Red Hat OpenShift, both OKE and OCP, Kind, K3S, and K3D. Support for these clusters varies, and you might need to consider the option of using open-source Istio depending on your needs. To establish trust between multiple clusters, use Root CA for certificate authority.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.