Skip to main content

05 · North-south ingress — MetalLB + Gateway API

External traffic into the application RKE2 cluster · no cloud LB, no NodePort · request topology + sequence. · interactive original ↗

EXTERNALNETWORK FABRICAPP RKE2 · GATEWAY NODEAPP RKE2 · BACKENDSExternal clienthttps://app.corp.exampleDNS → VIP 10.10.30.2011resolve + route to VIPToR leaf pair · MLAGECMP route for VIP via BGP2forward on guest VLAN 300BGP session — speakers advertise VIP /32APP-WORKER VM · ANY NODE CAN HOST THE ACTIVE GATEWAYNIC · VLAN 300MetalLB speakerowns VIP 10.10.30.201Service type LoadBalancer3Gateway pod · EnvoyTLS terminate · HTTPRoutehost + path → backendRef4Gateway · GatewayClass envoy5CNI overlay 10.42/16BACKEND SERVICE → ENDPOINTSHTTPRoute backendRefClusterIP · never exposedapp pod · worker-1app pod · worker-2app pod · worker-36response returns via the same VIP — symmetric path

Sequence​

  1. DNS. Client resolves app.corp.example to the MetalLB VIP and sends TLS SYN to 10.10.30.201:443.
  2. Fabric. ToR has the VIP /32 via BGP (or ARP in L2 mode) and forwards to a gateway node's NIC on guest VLAN 300.
  3. MetalLB. Node accepts traffic for the LoadBalancer Service and delivers it to the Gateway (Envoy) pod.
  4. Gateway API. Envoy terminates TLS, matches listener + HTTPRoute (host/path/header), applies policy.
  5. Backend. Request forwarded to a ready endpoint of the backend Service over the CNI overlay.
  6. Return. Response leaves through the same VIP; failover: BGP withdraws routes / another speaker takes over in seconds.

Pods spread across worker VMs (topology spread) — the gateway load-balances over all ready endpoints. Backends stay ClusterIP and are never exposed directly.

Design notes​

MetalLB pool​

Dedicated IPAddressPool per guest VLAN (e.g. 10.10.30.200–250). BGP mode peers with the ToR pair for ECMP + fast failover; L2 mode is the simple fallback.

Gateway API replaces Ingress​

One shared Gateway (Service type LoadBalancer → MetalLB) per cluster; teams attach HTTPRoutes in their own namespaces — role separation built in.

Scope​

Runs only in the application RKE2 cluster. Harvester/storage cluster APIs keep kube-vip VIPs; Ceph VLANs 210/211 are never exposed through the gateway.