Restrict a pod to use an IP address in a specific range

    Value

    When Kubernetes pods interact with external systems that make decisions based on IP ranges (for example legacy firewalls), it can be useful to define several IP ranges and explicitly assign pods to those ranges. Using Calico IP Address Management (IPAM), you can restrict a pod to use an address from within a specific range.

    This how-to guide uses the following features:

    • Calico IPAM
    • IPPool resource

    Concepts

    The Kubernetes pod CIDR is the range of IPs Kubernetes expects pod IPs to be assigned from. It is defined for the entire cluster and is used by various Kubernetes components to determine whether an IP belongs to a pod. For example, kube-proxy treats traffic differently if that traffic is from a pod than if it is not. All pod IPs must be in the CIDR range for Kubernetes to function correctly.

    IP pools are ranges of IP addresses from which Calico assigns pod IPs. By default, Calico creates an IP pool for the entire Kubernetes pod CIDR, but you can change this to break the pod CIDR up into several pools. You can control which pool Calico uses for each pod using node selectors, or annotations on the pod or the pod’s namespace.

    The features in this How to guide require:

    • Calico IPAM
    • Manifest

    The IPAM plugin can be queried on the default Installation resource.

    If your cluster is using Calico IPAM, the above command should return a result of .

    SSH to one of your Kubernetes nodes and examine the CNI configuration.

    Look for the entry:

    If it is present, you are using the Calico IPAM. If the IPAM is not Calico, or the 10-calico.conflist file does not exist, you cannot use these features in your cluster.

    How to

    Annotate the pod with key cni.projectcalico.org/ipv4pools and/or and value set to a list of IP pool names, enclosed in brackets. For example:

    Note the use of the escaped \“ for the inner double quotes around the pool names.

    Annotate the namespace with key cni.projectcalico.org/ipv4pools and/or and value set to a list of IP pool names, enclosed in brackets. For example:

    Note the use of the escaped \" for the inner double quotes around the pool names.

    If both the pod and the pod’s namespace have the annotation, the pod annotation takes precedence.

    For help configuring Calico IPAM, see .