Every cluster also routes and delivers packets to Services. Each Service gets a Virtual IP. Konvoy uses kube-proxy to implement this.
The Service IPs are managed by the Kubernetes control plane, specifically kube-controller-manager, which is given the CIDR from which to allocate Service IPs.
apiVersion: v1kind: Podmetadata: name: kube-controller-managernamespace: kube-systemspec: containers: - command: - kube-controller-manager - --service-cluster-ip-range=10.96.0.0/12
Calico allocates Pod IPs from a range defined in the Installation resource. For example:
apiVersion: operator.tigera.io/v1kind: Installationspec: calicoNetwork: ipPools: - blockSize: 26cidr: 192.168.0.0/16
Calico divides this range into blocks, allocates blocks to nodes, and records the allocation for each node in a BlockAffinity resource. For example:
apiVersion: v1items: - apiVersion: crd.projectcalico.org/v1kind: BlockAffinityname: ip-10-0-104-134.us-west-2.compute.internal-192-168-164-128-26spec: cidr: 192.168.164.128/26deleted: "false"node: ip-10-0-104-134.us-west-2.compute.internalstate: confirmed - apiVersion: crd.projectcalico.org/v1kind: BlockAffinitymetadata: name: ip-10-0-129-232.us-west-2.compute.internal-192-168-134-0-26spec: cidr: 192.168.134.0/26deleted: "false"node: ip-10-0-129-232.us-west-2.compute.internalstate: confirmed
Note that each node gets a
/26 allocation, as specified by the
blockSize field in the Installation resource.
The Kubernetes control plane still takes some inputs related to Pod networking and uses them, but they have no effect. For example, kube-controller-manager is given a cluster CIDR, and told to allocate CIDRs to each node:
apiVersion: v1kind: Podmetadata: name: kube-controller-managernamespace: kube-systemspec: containers: - command: - kube-controller-manager - --allocate-node-cidrs=true - --cluster-cidr=192.168.0.0/16 - --service-cluster-ip-range=10.96.0.0/12
It does in fact do this, setting the
spec.podCIDR field on each Node resource. However, these values are not used by any component. Importantly, they are not used by Calico.