Managed Site-to-Site Router

Site Router connects a tenant namespace to a remote network over an IPsec site-to-site tunnel. Workloads in the namespace and hosts in the remote networks reach each other by their real addresses: traffic is routed, not translated, so a workload sees the actual client address. Whole subnets are reachable in both directions for TCP, UDP, ICMP and SCTP. The router runs as a VM ( barerouter) in the tenant namespace.

Use it when a remote site and your workloads need to reach each other by their own addresses. It is not a NAT gateway: it does not hide tenant traffic behind one address and does not forward inbound connections to particular services.

How it works

Each instance runs a gateway VM in the tenant namespace and exposes it through a LoadBalancer Service named site-router-<name>-tunnel, which takes one address from the tenant’s LoadBalancer pool and listens on UDP 500 (IKE) and UDP 4500 (NAT-T). The remote peer starts the tunnel to that address; the gateway only answers. ESP always travels encapsulated in UDP, and TCP MSS is clamped to fit the tunnel.

The platform adds a route for every network in remoteCIDRs to the namespace, pointing at the gateway. Pods pick that route up only when they are created, so pods created before the route was added do not have it: restart them. The PendingRoutes event names the pods that still miss the route.

Example

A tunnel to one remote peer with one remote network and an explicit pre-shared key. Leave out peer.auth.psk to have a key generated and stored in the Secret site-router-<name>-psk under the key psk.

peer:
  address: 203.0.113.10        # public address the remote peer connects from
  auth:
    psk: "replace-with-a-strong-pre-shared-key"
remoteCIDRs:
  - 192.168.50.0/24            # remote network to make reachable

remoteCIDRs must not overlap the cluster pod, service or join networks, node addresses or allocated LoadBalancer and external service addresses. An overlapping value is rejected when the application is created or updated, and the error names the network it collides with.

Configuring the remote peer

The peer has to initiate the tunnel. To find the gateway address, run kubectl -n <namespace> get service site-router-<name>-tunnel.

Events

The application reports what it is waiting for or why it failed through Kubernetes events:

Limitations

• One remote peer per instance. Reach another site with another instance.
• A remote network can be routed by only one instance in a namespace.
• The gateway only answers; the remote peer must start the tunnel.
• Each instance takes one address from the tenant’s LoadBalancer pool, so the pool size and quota bound the number of sites.
• The gateway is a KubeVirt VM, so the application is available only where virtualization is enabled.

Parameters

Tunnel configuration

Routing configuration

Common parameters

Advanced parameters