<p>I would like to build a web application that processes video from users' webcams. It looks like WebRTC is ideal for this project. But, I'm having a hard time creating a peer connection between the user's machine and a pod in my Kubernetes cluster. How would you connect these two peers?</p>
<p>This question on Server Fault discusses the issue I'm running into: <a href="https://serverfault.com/questions/954715/webrtc-mcu-sfu-inside-kubernetes-port-ranges">WEBRTC MCU/SFU inside kubernetes - Port Ranges</a>. WebRTC wants a bunch of ports open so users can create peer connections with the server but Kubernetes has ports closed by default. Here's a rephrasing of my question: How to create
RTCPeerConnections connecting multiple users to an application hosted in a Kubernetes cluster? How should network ports be setup?</p>
<p>The closest I've come to finding a solution is <a href="https://cloud.google.com/solutions/orchestrating-gpu-accelerated-streaming-apps-using-webrtc" rel="noreferrer">Orchestrating GPU-accelerated streaming apps using WebRTC</a>, their code is available on <a href="https://github.com/GoogleCloudPlatform/selkies-vdi" rel="noreferrer">GitHub</a>. I don't fully understand their approach, I believe it depends on <a href="https://istio.io/" rel="noreferrer">Istio</a>.</p>

<p>The document you link to is helpful, <a href="https://cloud.google.com/solutions/orchestrating-gpu-accelerated-streaming-apps-using-webrtc" rel="noreferrer">Orchestrating GPU-accelerated streaming apps using WebRTC</a></p>
<p>What they do to allow for <code>RTCPeerConnection</code> is:</p>
<p>Use two separate Node pools (group of Nodes):</p>
<ul>
<li>Default Node pool - for most components, using <code>Ingress</code> and load balancer</li>
<li>TURN Node pool - for STUN/TURN service</li>
</ul>
<h2>STUN/TURN service</h2>
<p>The STUN/TURN service is <em>network bound</em> and deployed to dedicated nodes. It is deployed with one instance on each node in the node pool. This can be done on Kubernetes using a <a href="https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/" rel="noreferrer">DaemonSet</a>. In addition this service should use host networking, e.g. all nodes has its ports accessible from Internet. Activate host networking for the PodTemplate in your <code>DaemonSet</code>:</p>
<pre><code>hostNetwork: true
</code></pre>
<p>They use <a href="https://github.com/coturn/coturn" rel="noreferrer">coturn</a> as STUN/TURN server.</p>
<blockquote>
<p>The STUN/TURN service is run as a DaemonSet on each node of the TURN node pool. The coTURN process needs to allocate a fixed block of ports bound to the host IP address in order to properly serve relay traffic. A single coTURN instance can serve thousands of concurrent STUN and TURN requests based on the machine configuration.</p>
</blockquote>
<h3>Network</h3>
<p>This part of their network diagram shows that some services are served over <strong>https</strong> with an <em>ingress gateway</em>, whereas the STUN/TURN service is through a different connection using <strong>dtls/rtp</strong> to the nodes exposed via host network.</p>
<p><a href="https://i.stack.imgur.com/Gzs6u.png" rel="noreferrer"><img src="https://i.stack.imgur.com/Gzs6u.png" alt="Network" /></a></p>
