<p>The <a href="https://www.weave.works/docs/net/latest/concepts/router-encapsulation/" rel="nofollow noreferrer">sleeve mode</a> of Weave Net allows adding nodes behind NAT to the mesh, e.g. machines in a company network without external IP.</p>

<p>When Weave Net is used with Kubernetes, such nodes can be added to the cluster. The only drawback (besides the performance compared to <a href="https://www.weave.works/docs/net/latest/tasks/manage/fastdp/" rel="nofollow noreferrer">fastdp</a>) seems to be that the Kubernetes API server can't reach the Kubelet port, so attaching to a Pod or getting logs doesn't work.</p>

<p>Is it somehow possible to work around this issue, e.g. by connecting to the Kubelet port of a NATed node through the weave network instead?   </p>

<p>Taking under consideration how <code>kubectl exec</code> works and looking at Weave Net documentation makes it impossible to fix the cluster connectivity problem with Weave CNI.</p>

<p>Weave uses the underlying network for sending a packet to the node. I can't find any information saying that it is allowed to put the cluster node behind the NAT. More details can be found <a href="https://www.weave.works/docs/net/latest/concepts/fastdp-how-it-works/" rel="nofollow noreferrer">here</a></p>

<p>Therefore it is impossible to work around this issue as you suggested.</p>

<p>I hope it helps.</p>
