Tunneling through a single external node defeats the purpose of hosting k8s in home server.

Maybe the external ingress node can be a load balancer controlled by the k8 cluster. But then you still have to communicate with the home server and it has no exposed ip address

> Tunneling through a single external node defeats the purpose of hosting k8s in home server.

How so? You can just rent a cheap server to tunnel through, while having the benefits of your home machine(s) for compute.

> Maybe the external ingress node can be a load balancer controlled by the k8 cluster. But then you still have to communicate with the home server and it has no exposed ip address

Do you mean that you wouldn’t be able to access the K8s control plane endpoint then (which you could if configured properly)? Or something else?

>how so?

SPOF

And having a single IP address, with one ISP at home isn't a SPOF?

You are adding a(nother) SPOF.

@TZubiri, Then if that is a risk you accept, you could have multiple VPS's and load balance back to your home network, eliminating the new SPOF.

(@'ing because we reached the maximum reply limit)

@Daviey

Or just get your very own static IP.

It's a ZPOF.

Routing happens automatically on nearby router routes

It's deep down a matter of taste, you have a home server in Arizona and you route users to a Hetzner server in Germany and then back?

Don't justify, just recognize it's in bad taste, seek to use ip addresses as geographical host identifiers. Do not hide origin or destination. Minimize

Are you even running a real homelab if you're not running MetalLB in BGP mode?!

Sarcasm obviously, but it's a fun exercise, especially if you get a real (v6, probably) net to announce.

Right?! Get some free IP space from he.net tunnel broker and build your own IPv6 AnyCast network using Quagga for BGP.

Kidding about building your own AnyCast network (although you really could…), but he.net tunnel broker is GOAT.

I wish Happy Eyeballs worked better or let me absolutely prefer IPv4, because every time I set up a free v6 tunnel I get banned about 2 days layer for pushing a few terrabytes over it, when all I wanted was to be able to SSH into every one of my containers on a cheap VPS separately. Or the tunnel is so slow, I'm degrading my entire internet connectivity.

>free v6 tunnel

There's your problem. You need some form of cost attached to some identity assets, anything under the IANA umbrella, ips/domain names. This is in order to prevent sybil attacks. This is all well studied under he hashcash bitcoin era as PoW.

So yeah, you actually need to spend some money not in exchange of something here, but as the very thing you need, you need to distinguish yourself from those that spend 0$, not because they are cheap, but because they may do it 1000 times and ruin it your pooled reputation.

Unfortunately there's quite a market gap if you need bandwidth. I can't just pay HE 10 bucks a month, their service doesn't work that way. Hetzner would work, but their IP space is very often randomly blocked from lots of things.

> because every time I set up a free v6 tunnel I get banned about 2 days layer for pushing a few terrabytes over it, when all I wanted was to be able to SSH into every one of my containers

can you describe a bit more? I cannot connect the dots here on how terabytes are tied to free v6 tunnel - likely I'm missing some details. Thank you in advance.

If someone else provides IPv6 connectivity to you, you use their bandwidth. Some apps like Steam see IPv6 connectivity and use it regardless of what you'd prefer it to use, hinting mechanisms and all. So while I just wanted to use the tunnel for things that IPv4 does not provide, I always end up tunneling half my traffic over it, which free services don't like.

It's on my bucket list.

My Unifi Cloud Gateway Max doesn't (yet) support BGP, but other Unifi devices do, so I do hope that it'll come to my device to. If not, I'll have to think of other ways to test it. But in the meantime, there's plenty of other stuffs to learn.

I have a real, ISP-routed IPv6 net to play with.