3 ms·
I would need to double check, but isn’t it still running an overlay? Just one which is transparent to you?
by AlphaSite 6y ago
I would need to double check, but isn’t it still running an overlay? Just one which is transparent to you?
- bogomipz 6y agoWell an overlay network by definition is always going to be transparent to you. But no the AWS VPC CNI does not create an overlay. It's just layer 3. It works by adding ENIs to your worker nodes with secondary IP addresses on them. And those secondary IPs are from your VPC's address space. See: https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/cni-proposal.md https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/c...
- oneplane 6y agoYep, another reason it does that is to spread the risk and limit the need for tons of unchecked (no src/dst check) addresses in your VPC. In the end there is no ideal scenario; boils down to what works best for the use case (or what is the 'least worst' solution). Sometimes it gets you down, but those imperfections can turn a churn job into an interesting one.