How to put in communication two clusters in Kubernetes

Question

I have a situation like this:

• a cluster of web machines
• a cluster of db machines and other services

The question is how put in communication the 2 clusters in order to use some hostnames in /etc/hosts of web machines.

To protect your data, is it safe create an ingress service to make visible the db from the external? I tried with a nodePort service (so using internal ip addresses) but I'm not able to put in contact db-web between different clusters

At the moment my temporary solution is:

a) define a public static ip with the command: gcloud compute addresses create my-public-static-ip --global

b) use an ingress configuration for my db service where I set the static ip with the option:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: my-public-static-ip 

c) in my daemonset.yaml I define a hostAliases:

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: my-daemonset

spec:
  updateStrategy:
    type: RollingUpdate

  template:            
    spec:
      nodeSelector:
        app: frontend-node

      terminationGracePeriodSeconds: 30

      hostAliases:
      - ip: <public_ip_addr>
        hostnames:
        - "my-db-service"

and it's working. But I'm not too convinced that this solution is the best or however correct on a live environment

Answer 1

In my opinion, I think the best approach to get 2 different Kubernetes Clusters(GKE-Google Kubernetes Engine) to communicate with each other is to use Istio - open platform to connect, manage, and secure microservices. Take a look at the following link:- https://istio.io/v1.3/docs/examples/multicluster/gke/. It is pretty straight forward and would also like to mention that Istio should fit well with implementations like Amazon Elastic Container, Azure Kubernetes Service etc as well.

Answer 2

This is a very good read and examples of how to do this, even if the clusters would be in different projects. https://github.com/GoogleCloudPlatform/gke-networking-demos/tree/master/gke-to-gke-peering (The same works in other clouds or with self-managed clusters like kops instead of GKE

Using istios multi-cluster feature is also valid but its an additional and complex component you install in your clusters and that might not be needed at all.

Answer 3

You can expose your db service with NodePort or LoadBalancer in your first cluster and then create service pointing to ip-endpoint in second.

Service on the second cluster may look like:

apiVersion: v1
metadata:
  name: pg-database
spec:
  ports:
  - protocol: TCP
    port: 5432
    targetPort: 5432

---

kind: Endpoints
apiVersion: v1
metadata:
  name: pg-database
subsets:
  - addresses:
      - ip: <IP address of load balancer or node>
    ports:
      - port: 5432