<p>I have a Kubernetes cluster in which there are some MySQL databases.</p>

<p>I want to have a replication slave for each database in a different Kubernetes cluster in a different datacenter.</p>

<p>I'm using Calico as CNI plugin.</p>

<p>To make the replication process work, the slaves must be able to connect to the port 3306 of the master servers. And I would prefer to keep these connections the most isolated as possible.</p>

<p>I'm wondering about the best approach to manage this.</p>

<p><a href="https://i.stack.imgur.com/VcqXP.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VcqXP.jpg" alt="enter image description here"></a></p>

<p>One of the ways to implement your idea is to use a new tool called <a href="https://submariner.io/" rel="nofollow noreferrer">Submariner</a>.</p>

<p>Submariner enables direct networking between pods in different Kubernetes clusters on prem or in the cloud.</p>

<p>This new solution overcomes barriers to connectivity between Kubernetes clusters and allows for a host of new multi-cluster implementations, <strong>such as database replication within Kubernetes across geographic regions and deploying service mesh across clusters.</strong></p>

<p>Key features of Submariner include:</p>

<p>Compatibility and connectivity with existing clusters: Users can deploy Submariner into existing Kubernetes clusters, with the addition of Layer-3 network connectivity between pods in different clusters.</p>

<p>Secure paths: Encrypted network connectivity is implemented using IPSec tunnels.
Various connectivity mechanisms: While IPsec is the default connectivity mechanism out of the box, Rancher will enable different inter-connectivity plugins in the near future.</p>

<p>Centralized broker : Users can register and maintain a set of healthy gateway nodes.</p>

<p>Flexible service discovery: Submariner provides service discovery across multiple Kubernetes clusters.</p>

<p><strong>CNI compatibility</strong>: Works with popular CNI drivers such as Flannel and <strong>Calico</strong>.</p>

<p><a href="https://github.com/rancher/submariner#prerequisites" rel="nofollow noreferrer">Prerequisites</a> to use it:</p>

<p>At least 3 Kubernetes clusters, one of which is designated to serve as the central broker that is accessible by all of your connected clusters; this can be one of your connected clusters, but comes with the limitation that the cluster is required to be up in order to facilitate inter-connectivity/negotiation</p>

<p>Different cluster/service CIDR's (as well as different Kubernetes DNS suffixes) between clusters. This is to prevent traffic selector/policy/routing conflicts.</p>

<p>Direct IP connectivity between instances through the internet (or on the same network if not running Submariner over the internet). Submariner supports 1:1 NAT setups, but has a few caveats/provider specific configuration instructions in this configuration.</p>

<p>Knowledge of each cluster's network configuration</p>

<p>Helm version that supports crd-install hook (v2.12.1+)</p>

<p>You can find more info with installation steps on <a href="https://github.com/rancher/submariner" rel="nofollow noreferrer">submariner github</a>.
Also, you may find <a href="https://www.infoq.com/news/2019/03/rancher-submariner-multicluster" rel="nofollow noreferrer">rancher submariner multi-cluster article</a> interesting and useful.</p>

<p>Good luck.</p>
