Connecting your Kubernetes cluster to on-premises resources

Writing microservices in containers and deploying them to a Kubernetes cluster running on IBM Cloud is a great way to create greenfield applications. Frequently you’ll also have mountains of useful data hosted by on-premises systems.  What if you can’t migrate this data to the cloud due to compliance reasons, but you still want to allow your new microservice application to leverage it?

In the IBM Cloud Container Service you can use a Vyatta Gateway Appliance or Fortigate Appliance as an IPSec VPN endpoint to connect your Kubernetes cluster to your on-premise datacenter. This allows your services running in Kubernetes to communicate with on-premise applications and resources through a secure encrypted tunnel.  Information on how to configure the IPSec VPN endpoint with a Vyatta Gateway Appliance can be found here.

Setting up a Vyatta Gateway Appliance or Fortigate Appliance as an IPSec VPN endpoint is not a simple, straight forward task.   The complexity and cost of both of these appliances makes them unattractive solutions when you have a single small Kubernetes cluster or multiple small clusters located in different IBM Cloud regions. The IBM Cloud Container Service now supports a third IPSec VPN method, the Strongswan IPSec VPN service, which resolves these concerns.

Strongswan IPSec VPN service

Unlike the Vyatta Gateway Appliance or Fortigate Appliance solutions which sit outside of your cluster, the Strongswan IPSec VPN service is completely integrated within your Kubernetes cluster. The IPSec VPN endpoint is provided as a Kubernetes pod. Configuration, deployment, and management of the Strongswan IPSec VPN service is also much easier since the normal Kubernetes commands can be utilized. Better yet, there is no additional charge for using the Strongswan IPSec VPN service.

The Strongswan IPSec VPN service consists of a Kubernetes service, a deployment, a daemon set, and multiple config maps. All of these resources and bundled together and delivered as a single Kubernetes Helm chart:

• Configuration of the VPN service is provided by setting a handful of fields in a config yaml file. If unique VPN settings are required, a complete IPSec configuration file can be specified.

• A single Helm install command deploys the Strongswan IPSec VPN configuration and automatically creates all the required Kubernetes resources.

• Once VPN connectivity is established with the on-premises data center, a Kubernetes daemon setconfigures routing on each of the worker nodes.

• Helm provides additional commands that allow: status, upgrade , rollback , and deletion of the VPN service after it has been deployed.

For more information on how you can use the Strongswan IPsec VPN service to securely connect your worker nodes to your on-premises data center, see Setting up VPN connectivity with the Strongswan IPSec VPN service in the IBM Cloud Container Service documentation.