External LB to K8s?

[rrichardson]

We have k8s set up as a pure ipv6 network where each host has it's own private ipv6 network.
I would like to set up an external LB that can direct requests to pods for (say) an ingress controller

The pod networks are reachable from the LB machine.

Is there a way to start kube-nftlb in this configuration?
Basically I think the only change vs what the docs currently describe is I'd need to specify where kube-nftlb should find the kubeconfig so that it can communicate with the API server(s)

[rrichardson]

I just found https://github.com/zevenet/kube-nftlb/blob/master/pkg/auth/auth.go#L24 so I should be able to supply the kubeconfig path on the command line.

So I should be able to run this on an external node, provided that it can reach the Pod network.

DNat should theoretically work, provided that the default GW for the pod networks are this LB machine, yeah?

(otherwise, source nat should work, yeah?)

[cano-devel]

hi @rrichardson,
As you mentioned, configuring the kubeconfig, kube-nftlb should be able to connect with the API server and configure the local load balancing service where the external lb will send the traffic. The DNAT should work too.
Regards

[alexeadem]

Hi @cano-devel can kube-nftb be used as an external load balancer in the same metallb is used or is this a replacement for kube-proxy?

[rrichardson]

(Someone please correct me if I have any of this wrong)
As I see it, metallb and kube-nftlb do approximately the same thing, but in very different ways.
Both are used to expose service ports to the outside world.
Metallb runs on all k8s hosts, and uses iptables and a free floating Ip to "bind" the IP to a service IP. The typical use case is to teleport a LoadBalancer service to its own IP, so that it can be used to expose multiple services to the outside world.

kube-nftlb is more of a port-forwarding with NAT (or direct server return) - It can be used for the above use-case, but instead of binding to a virtual nic, I think it just forwards the ports on whatever host it is running. It can be used to create a path from an outer network into Kubernetes' inner "private" service and pod networks