14

This command will give you the pod CIDR addresses for each of the nodes in your cluster. kubectl get nodes -o jsonpath='{.items[*].spec.podCIDR}'


8

TL;DR There are a number of use cases for port mapping, but for DevOps at scale the primary reason is generally to enable mapping well-known service ports to available ports on the host. This matters when you're running large numbers of containers that use the same port by default, and you don't want to manually assign or track alternative port numbers. A ...


6

This will show pod network CIDR which used by kube-proxy kubectl cluster-info dump | grep -m 1 cluster-cidr


6

Internal Docker networks mean there is no gateway configured to reach the outside internet, you can only reach other containers from that network. In your scenario, none of your networks should have this definition. Without setting the internal network flag, containers can reach out of the docker host, potentially to the internet if the host has that access....


6

Assuming the following: YOUR_PC, has Redis client, SSH client, SSH access to SSH_SERVER SSH_SERVER, has SSH server, redis access to REDIS_SERVER REDIS_SERVER, has Redis server Set up the tunnel from YOUR_PC, port 1234, to REDIS_SERVER:REDIS_PORT, via SSH_SERVER ssh SSH_SERVER -L 1234:REDIS_SERVER:REDIS_PORT On another terminal, on YOUR_PC, run the redis ...


4

I am accessing my home network with a VPN running in a docker container in my home server. That sounds similar to what you want to do. Here's how I configured it (using this docker image - note that the documentation of the docker image should be enough) Use a “convenience” environment variable to store the path to your persistent storage location that ...


4

Docker actually provides DNS support for networking between containers. This means that if you define your database connection as: http://redis:6379 This will resolve redis to the correct network address, given that you fulfill the following: All containers are on the same network The containers have been named This can either be done manually by ...


3

The --cluster-cidr / --pod-network-cidr is fed to kube-controller-manager config. You can simply do ps -ef | grep "cluster-cidr" to get what you want.


3

When you instantiate a new container it has its own networking, isolated from the host. So you can NOT access the container directly from its port. ports: - 8080:80 this command will specify that you are fowarding your host port to the container port. In your local host in the port 8080 will call the port 80 of your container. There are some ways to ...


3

I found the solution ... Check your network interfaces (ifconfig -a cni0). Good config is: cni0: flags=4163 mtu 1450 inet 10.244.0.1 netmask 255.255.255.0 broadcast 0.0.0.0... That subnet (10.244.0.0) configured in flannel-deploy.yaml But, by default, a new server may have: cni0: flags=4163 mtu 1450 inet 192.168.0.1 netmask ...


3

There are a couple of things that you can rule out, thanks to the testing that you have already done. You know your container port has an active network socket, that is listening for and accepting connections. You also know that your EC2 instance has working networking. I can think of three obvious problems: Your host is using local DNS resolution to ...


3

For my Peering Connection, I went to: "Actions" -> "Edit DNS Settings" -> "Allow accepter VPC (vpc-<id>) to resolve DNS of requester VPC (vpc-<id-default>) hosts to private IP" and checked it. (It was unchecked before). I had to wait a little while before this took effect.


2

We have redis connected through stunnel. That way you don't have to always establish the ssh connection, which can be a problem. Here is an article on how to setup redis through stunnel, which I won't copy into this answer. Feel free to edit. http://bencane.com/2014/02/18/sending-redis-traffic-through-an-ssl-tunnel-with-stunnel/


2

Why do you want to create a new Manager node, risking damaging your raft consensus and cie? I find it way easier to simply expose the docker socket locally, as if you were working inside the node, but with your Windows environment. To do so, simply open a ssh tunnel that exposes /var/run/docker.sock: ssh -M -S ~/.docker.sock \ -fnNT -4 -L localhost:...


2

There is a comprehensive document about k8s' DNS. According to this document one could validate whether the DNS is working by running: busybox.yaml apiVersion: v1 kind: Pod metadata: name: busybox namespace: default spec: containers: - image: busybox command: - sleep - "3600" imagePullPolicy: IfNotPresent name: busybox ...


2

If you have a user-defined network set to bridge, you can access other containers by their container's name which is automatically as hostname for containers inside same network. So from containerA you could do ping containerB without problems. In your case it would be changing the setting to containerB_name:(container B needed port)/route


2

Do you need to run it beside a VPN "OpenVPN service" ? I think using below would solve the issue for clearing any unused networks by at least 1 container. $ docker network prune


2

Are they in the same VPC? If yes it should just work as the VPC CIDR route will take care of all the subnets intercommunication.


2

When you ping nginx the docker swarm returns Virual IP of swarm service named "nginx" not the container ip. This is is how internal load balancer works - you can have multiple replicas of "nginx" containers behind the "nginx" service.


2

Maybe a simple shell script would be more useful. If must to use ansible, it could be something like that (assuming you have all servers in group testall): - hosts: testall connection: local gather_facts: false tasks: - wait_for: timeout: 2 port: 43 host: '{{ (ansible_ssh_host|default(ansible_host))|default(...


2

With a bridged adapter, your VM would get its IP from the host machine's network DHCP server. This would allow it to be pinged from your internal network. I'd also specify in your configuration that your cable is connected as so: VBoxManage modifyvm "VM" --cableconnected1 on Port forwarding in the VM's configuration would also work. It would allow access ...


2

This looks to be answered on offcail docs here NodeLocal DNSCache improves Cluster DNS performance by running a dns caching agent on cluster nodes as a DaemonSet. With this architecture, Pods will reach out to the dns caching agent running on the same node, thereby avoiding iptables DNAT rules and connection tracking. Having a local cache will help improve ...


2

No, Kubernetes will load-balance requests to a ClusterIP across all Pods with matching labels (and passing readiness checks). It won't keep traffic within the same Node. Q: So how does the NodeLocal DNS Cache achieve to keep DNS requests local to the Node? A: When using the NodeLocal DNS Cache, it is necessary to pass a extra arg to the Kubelet of each ...


2

Docker should avoid using a network if there's a route to that network (see ip r). You can whitelist networks that docker is allowed to use with configurations in several places: You can adjust bip in /etc/docker/daemon.json which controls the docker bridge network named bridge. This needs to be set to a gateway ip with CIDR notation. You can adjust default-...


2

If you want to modify the configuration and rules, so you must save the current configuration to a file. So step one is to save the rules configuration by typing the following commands: $ sudo iptables-save > /root/my-iptables.rules To restore it just use the command iptables-restore: $ sudo iptables-restore < /root/my-iptables.rules ⚠️ When you ...


2

In short, docker exec is used to operate an already-running container, while docker run -it starts a new container interactively. When you ran docker run -it --network foo --rm redis redis-cli -h rd you created a 2nd container, this time using the redis-cli image, which was used to query your running redis container. Were you to repeat the steps you took, ...


2

If it is FTP (and not FTPS) then yes, it is a high severity risk. You are sending unencrypted traffic over the open internet. Even if you are whitelisting specific IP addresses, the traffic is still unencrypted between those specific instances. In addition, FTP is a very old (created in 1971) and non-secure protocol. It is not meant to be a secure method of ...


2

There are a couple of things here: The indent of "with_items" on the debug module is wrong, it should the same level as the "debug" word. More importantly, in this case the "with_items" variable on the debug is wrong. When you added "register" to the cli_command module, you actually said "collect the output from ...


1

I am going to suggest an approach that I would not necessarily recommend, because I do not consider it a manageable, scalable solution: SSH port forwarding. SSH is a Swiss Army knife in terms of its features. Virtually any port can be securely forwarded to any other port on a remote machine, and indeed through a remote machine to a target machine beyond. ...


1

Do that: You cannot attach several networks using the --network option. You have to rely on the docker network connect command. So if you want the multiple network interfaces to be available at container startup, you have to do it in three steps: create the container, connect the extra network needed, and finally run the container. # create a container, ...


Only top voted, non community-wiki answers of a minimum length are eligible