<p>I had recently began to walk in to the Kubernetes world, there is a lot of information and most of time I get really confused;
Then I'd like to ask how I can choose the better way to administrate an infrastructure will like this:</p>

<p><a href="https://i.stack.imgur.com/9S27C.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/9S27C.jpg" alt="enter image description here"></a></p>

<p>The node and the Kubernetes master are isolated in different DMZ, the port and the direction will be opened as described in the picture.</p>

<p>Which way you will use to let the pods going to be executed on the right node? (for example, an Nginx pod go only on Web1 and/or web2 and a pgSQL pod go only executed on DB1 and/or DB2) use the server labeling system is good enough or have better solution to manage this?</p>

<p>A second doubt I have is the service have to be reachable from the external word directly from the node, so if I want to use replicas, the Web1 and Web2 should listen on same IP address the service is exposed, I suppose, or could this be managed via the kube-proxy? At the moment I thinking about configure a distributed switch between the nodes and set the external ip address of the pod one of the IP attached to the distributed switch.</p>

<p>It is also a good solution or have some better way to do it?  </p>

<blockquote>
  <p>Which way you will use to let the pods going to be executed on the right node?</p>
</blockquote>

<p><a href="https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector" rel="nofollow noreferrer">nodeSelector</a>, simplest way because you add a label to the node <code>kubectl label nodes k8s-node-1 disktype=ssd</code> which can be verified by <code>kubectl get nodes --show-labels</code> and inside pod <code>yaml</code> under <code>spec</code> you add:</p>

<pre><code>nodeSelector:
    disktype: ssd
</code></pre>

<p><a href="https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature" rel="nofollow noreferrer">Node affinity</a>, is more complex and more expressive as you are no longer limited to exact matches. <strong>Keep in mind this is still a beta feature.</strong></p>

<blockquote>
  <p>A second doubt I have is the service have to be reachable from the external word directly from the node, so if I want to use replicas, the Web1 and Web2 should listen on same IP address the service is exposed, I suppose, or could this be managed via the kube-proxy?</p>
</blockquote>

<p>Here, I think you will need to use <a href="https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer" rel="nofollow noreferrer">Type LoadBalancer</a> as a <code>Service</code>, most cloud providers have they own internal LoadBalancer <a href="https://kubernetes.io/docs/concepts/services-networking/service/#service-tabs-1" rel="nofollow noreferrer">GCP</a>, <a href="https://kubernetes.io/docs/concepts/services-networking/service/#service-tabs-2" rel="nofollow noreferrer">AWS</a>, <a href="https://kubernetes.io/docs/concepts/services-networking/service/#service-tabs-3" rel="nofollow noreferrer">Azure</a>. There is also <a href="https://github.com/google/metallb" rel="nofollow noreferrer">MetalLB</a> which is implementation for bare metal Kubernetes clusters.</p>

<p>Hope this helps You.</p>

<p><strong>EDIT:</strong></p>

<p>OP recommends using <a href="https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-isolation-restriction" rel="nofollow noreferrer">Node restriction</a> which in his example a better solution to let pods running dynamically on a sub-set of node in the cluster.</p>
