3

Inside of a Kubernetes Cluster I am running 1 node with 2 deployments. React front-end and a .NET Core app. I also have a Load Balancer service for the front end app. (All working: I can port-forward to see the backend deployment working.)

Question: I'm trying to get the front end and API to communicate. I know I can do that with an external facing load balancer but is there a way to do that using the clusterIPs and not have an external IP for the back end?

The reason we are interested in this, it simply adds one more layer of security. Keeping the API to vnet only, we are removing one more entry point.

If it helps, we are deploying in Azure with AKS. I know they have some weird deployment things sometimes.

BSMP
  • 4,596
  • 8
  • 33
  • 44
TallOrderDev
  • 469
  • 4
  • 15

3 Answers3

3

Pods running on the cluster can talk to each other using a ClusterIP service, which is the default service type. You don't need a LoadBalancer service to make two pods talk to each other. According to the docs on this topic

ClusterIP exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. This is the default ServiceType.

As explained in the Discovery documentation, if both Pods (frontend and API) are running on the same namespace, the frontend just needs to send requests to the name of the backend service.

If they are running on different namespaces, the frontend API needs to use a fully qualified domain name to be able to talk with the backend.

For example, if you have a Service called "my-service" in Kubernetes Namespace "my-ns" a DNS record for "my-service.my-ns" is created. Pods which exist in the "my-ns" Namespace should be able to find it by simply doing a name lookup for "my-service". Pods which exist in other Namespaces must qualify the name as "my-service.my-ns". The result of these name lookups is the cluster IP.

You can find more info about how DNS works on kubernetes in the docs.

Jose Armesto
  • 12,794
  • 8
  • 51
  • 56
2

The problem with this configuration is the idea that the Frontend app will be trying to reach out to the API via the internal cluster. But it will not. My app, on the client's browser can not reach services and pods in my Kluster.

My cluster will need something like nginx or another external Load Balancer to allow my client side api calls to reach my API.

You can alternatively used your front end app, as your proxy, but that is highly not advised!

BSMP
  • 4,596
  • 8
  • 33
  • 44
TallOrderDev
  • 469
  • 4
  • 15
1

I'm trying to get the front end and api to communicate

By api, if you mean the Kubernetes API server, first setup a service account and token for the front-end pod to communicate with the Kubernetes API server by following the steps here, here and here.

is there a way to do that using the clusterIPs and not have an external IP for the back end

Yes, this is possible and more secure if external access is not needed for the service. Service type ClusterIP will not have an ExternalIP and the pods can talk to each other using ClusterIP:Port within the cluster.

Vikram Hosakote
  • 3,528
  • 12
  • 23
  • "React front-end and a Dotnet Core app." Sorry for any confusion. The API is a in-house build rest API for our app. – TallOrderDev Feb 13 '18 at 20:14
  • @TallOrderDev cool, if not communicating with the kubernetes API server, no need to setup service account and token for the front-end pod. Just service type `ClusterIP` should make the pods talk to each other using `ClusterIP:Port` within the cluster. – Vikram Hosakote Feb 13 '18 at 20:43
  • @TallOrderDev Upvote and accept my answer if you think my answer is useful so that others know this is the right answer, thanks! – Vikram Hosakote Feb 13 '18 at 20:44