Networking¶

This document describes the network topology, required ports, and DNS configuration of a yake-ansible deployment on OpenStack.

Network Topology¶

Layer Overview¶

All address ranges are configurable defaults. They must be non-overlapping across all layers. See configuration.md for the relevant variables.

The garden cluster subnet is set with clusterapi_cluster_openstack_managed_subnets, the pod network with clusterapi_cluster_pod_cidr_blocks, and the managed seed node range per seed with workers_cidr (or subnet_pool). The shoot defaults are set on the seed; the internal seed uses 100.100.0.0/16 (nodes), 100.101.0.0/16 (pods) and 100.102.0.0/16 (services) as shoot defaults.

Each layer gets its own Neutron network and is isolated from the others by separate security groups. CAPO sets allowAllInClusterTraffic: true; node-to-node traffic within a cluster is unrestricted at the OpenStack level; isolation is handled by Kubernetes NetworkPolicies.

Shoot Control Plane and Worker Connectivity¶

This is the central networking concept in Gardener.

Shoot control planes run on the seed, not on the shoot workers. When a shoot is created, Gardener deploys its entire control plane (kube-apiserver, etcd, controller-manager, scheduler) as pods in a dedicated namespace on the seed cluster. Shoot worker nodes are plain VMs with only kubelet.

How worker nodes reach their control plane:

Shoot workers live in their own Neutron network and cannot directly route to the seed's pod network. Gardener bridges this with two components on every worker node:

• vpn-shoot-client establishes an encrypted tunnel to vpn-seed-server in the shoot's namespace on the seed. All traffic between workers and the control plane flows through this tunnel.
• konnectivity-agent handles the reverse channel from the API server to kubelet, used for kubectl exec, kubectl logs, and metrics scraping.

How users reach the shoot API:

The shoot's kube-apiserver is exposed via a dedicated LoadBalancer service on the seed, creating an Octavia LB with its own floating IP. This is the endpoint users receive in their kubeconfig.

Quota implication: every shoot adds at least one floating IP and one load balancer to the seed's OpenStack project.

Ports¶

External (reachable from outside OpenStack)¶

Gardener Component Ports (in-cluster only)¶

Kubernetes Control Plane (in-cluster only)¶

DNS¶

Default backend: OpenStack Designate (openstack-designate). Alternatives: aws-route53, azure-dns, google-clouddns; set via gardener_operator_dns_provider_type.

OpenStack API Access¶

The control host and all cluster nodes require outbound access to the OpenStack API. Most deployments proxy all services behind a single HTTPS endpoint; the standard ports are listed for reference.

A custom CA certificate can be injected via clusterapi_cluster_openstack_cacert.

CNI¶

Configurable per cluster: cilium (default) or calico. Set via clusterapi_cluster_network for the garden cluster and gardener_operator_networking_type for seeds and shoots.

Container Registry¶

Nodes pull images through configurable mirrors. Defaults point to registry.osism.cloud. Override via clusterapi_cluster_container_registry_cache_* variables.

OpenStack Quota¶

See requirements.md for full quota requirements.