11

This command will give you the pod CIDR addresses for each of the nodes in your cluster. kubectl get nodes -o jsonpath='{.items[*].spec.podCIDR}'


8

TL;DR There are a number of use cases for port mapping, but for DevOps at scale the primary reason is generally to enable mapping well-known service ports to available ports on the host. This matters when you're running large numbers of containers that use the same port by default, and you don't want to manually assign or track alternative port numbers. A ...


5

Assuming the following: YOUR_PC, has Redis client, SSH client, SSH access to SSH_SERVER SSH_SERVER, has SSH server, redis access to REDIS_SERVER REDIS_SERVER, has Redis server Set up the tunnel from YOUR_PC, port 1234, to REDIS_SERVER:REDIS_PORT, via SSH_SERVER ssh SSH_SERVER -L 1234:REDIS_SERVER:REDIS_PORT On another terminal, on YOUR_PC, run the redis ...


4

Internal Docker networks mean there is no gateway configured to reach the outside internet, you can only reach other containers from that network. In your scenario, none of your networks should have this definition. Without setting the internal network flag, containers can reach out of the docker host, potentially to the internet if the host has that access....


4

I am accessing my home network with a VPN running in a docker container in my home server. That sounds similar to what you want to do. Here's how I configured it (using this docker image - note that the documentation of the docker image should be enough) Use a “convenience” environment variable to store the path to your persistent storage location that ...


4

Docker actually provides DNS support for networking between containers. This means that if you define your database connection as: http://redis:6379 This will resolve redis to the correct network address, given that you fulfill the following: All containers are on the same network The containers have been named This can either be done manually by ...


4

This will show pod network CIDR which used by kube-proxy kubectl cluster-info dump | grep -m 1 cluster-cidr


3

The --cluster-cidr / --pod-network-cidr is fed to kube-controller-manager config. You can simply do ps -ef | grep "cluster-cidr" to get what you want.


3

When you instantiate a new container it has its own networking, isolated from the host. So you can NOT access the container directly from its port. ports: - 8080:80 this command will specify that you are fowarding your host port to the container port. In your local host in the port 8080 will call the port 80 of your container. There are some ways to ...


3

I found the solution ... Check your network interfaces (ifconfig -a cni0). Good config is: cni0: flags=4163 mtu 1450 inet 10.244.0.1 netmask 255.255.255.0 broadcast 0.0.0.0... That subnet (10.244.0.0) configured in flannel-deploy.yaml But, by default, a new server may have: cni0: flags=4163 mtu 1450 inet 192.168.0.1 netmask ...


3

There are a couple of things that you can rule out, thanks to the testing that you have already done. You know your container port has an active network socket, that is listening for and accepting connections. You also know that your EC2 instance has working networking. I can think of three obvious problems: Your host is using local DNS resolution to ...


3

For my Peering Connection, I went to: "Actions" -> "Edit DNS Settings" -> "Allow accepter VPC (vpc-<id>) to resolve DNS of requester VPC (vpc-<id-default>) hosts to private IP" and checked it. (It was unchecked before). I had to wait a little while before this took effect.


2

We have redis connected through stunnel. That way you don't have to always establish the ssh connection, which can be a problem. Here is an article on how to setup redis through stunnel, which I won't copy into this answer. Feel free to edit. http://bencane.com/2014/02/18/sending-redis-traffic-through-an-ssl-tunnel-with-stunnel/


2

There is a comprehensive document about k8s' DNS. According to this document one could validate whether the DNS is working by running: busybox.yaml apiVersion: v1 kind: Pod metadata: name: busybox namespace: default spec: containers: - image: busybox command: - sleep - "3600" imagePullPolicy: IfNotPresent name: busybox ...


2

If you have a user-defined network set to bridge, you can access other containers by their container's name which is automatically as hostname for containers inside same network. So from containerA you could do ping containerB without problems. In your case it would be changing the setting to containerB_name:(container B needed port)/route


2

Do you need to run it beside a VPN "OpenVPN service" ? I think using below would solve the issue for clearing any unused networks by at least 1 container. $ docker network prune


2

Are they in the same VPC? If yes it should just work as the VPC CIDR route will take care of all the subnets intercommunication.


2

Maybe a simple shell script would be more useful. If must to use ansible, it could be something like that (assuming you have all servers in group testall): - hosts: testall connection: local gather_facts: false tasks: - wait_for: timeout: 2 port: 43 host: '{{ (ansible_ssh_host|default(ansible_host))|default(...


2

With a bridged adapter, your VM would get its IP from the host machine's network DHCP server. This would allow it to be pinged from your internal network. I'd also specify in your configuration that your cable is connected as so: VBoxManage modifyvm "VM" --cableconnected1 on Port forwarding in the VM's configuration would also work. It would allow access ...


2

This looks to be answered on offcail docs here NodeLocal DNSCache improves Cluster DNS performance by running a dns caching agent on cluster nodes as a DaemonSet. With this architecture, Pods will reach out to the dns caching agent running on the same node, thereby avoiding iptables DNAT rules and connection tracking. Having a local cache will help improve ...


2

No, Kubernetes will load-balance requests to a ClusterIP across all Pods with matching labels (and passing readiness checks). It won't keep traffic within the same Node. Q: So how does the NodeLocal DNS Cache achieve to keep DNS requests local to the Node? A: When using the NodeLocal DNS Cache, it is necessary to pass a extra arg to the Kubelet of each ...


2

Docker should avoid using a network if there's a route to that network (see ip r). You can whitelist networks that docker is allowed to use with configurations in several places: You can adjust bip in /etc/docker/daemon.json which controls the docker bridge network named bridge. This needs to be set to a gateway ip with CIDR notation. You can adjust default-...


2

If you want to modify the configuration and rules, so you must save the current configuration to a file. So step one is to save the rules configuration by typing the following commands: $ sudo iptables-save > /root/my-iptables.rules To restore it just use the command iptables-restore: $ sudo iptables-restore < /root/my-iptables.rules ⚠️ When you ...


2

In short, docker exec is used to operate an already-running container, while docker run -it starts a new container interactively. When you ran docker run -it --network foo --rm redis redis-cli -h rd you created a 2nd container, this time using the redis-cli image, which was used to query your running redis container. Were you to repeat the steps you took, ...


1

On Linux, containers live in separate network namespaces, so localhost or 127.0.0.1 on the container is not localhost on the host. I'm not sure about other OSes. You could expose a port to the host like this: docker run -p 3306:3306 mysql Then you can access it from any container at the host IP address, which for the default network is 172.17.0.1:3306. You ...


1

I am going to suggest an approach that I would not necessarily recommend, because I do not consider it a manageable, scalable solution: SSH port forwarding. SSH is a Swiss Army knife in terms of its features. Virtually any port can be securely forwarded to any other port on a remote machine, and indeed through a remote machine to a target machine beyond. ...


1

Do that: You cannot attach several networks using the --network option. You have to rely on the docker network connect command. So if you want the multiple network interfaces to be available at container startup, you have to do it in three steps: create the container, connect the extra network needed, and finally run the container. # create a container, ...


1

Your updated question completely changed my understanding :) Since the db is on a user-defined bridge in both cases, the advantages of using user-defined vs legacy/default bridges discussed in the doc section you referenced (which are applicable in both cases) aren't what differentiates the 2 cases. From that perspective they're equivalent. Original Answer:...


1

I could have mentioned this in comment first but I need 50 reputation to comment and I just joined this yesterday, So, may I know what you are trying to achieve? If I interpret correctly, you want to move your VMs to Docker and then make those docker interact with each other as well as with graphics which is running on host? So consider it this way, you ...


1

There are a few options (combining the existing answers and adding option for Calico, including example ouput): Option 1: Run this command On the master node (also applicable when running for example microk8s on Ubuntu) kubeadm config view | grep Subnet example output from local 3 node cluster, master node podSubnet: 172.16.0.0/16 serviceSubnet: 10.96.0....


Only top voted, non community-wiki answers of a minimum length are eligible