<p>I setup a Kubernetes cluster with calico.
The setup is &quot;simple&quot;</p>
<ul>
<li>1x master (local network, ok)</li>
<li>1x node (local network, ok)</li>
<li>1x node (cloud server, not ok)</li>
</ul>
<p>All debian buster with docker 19.03</p>
<p>On the cloud server the calico pods do not come up:</p>
<p>calico-kube-controllers-token-x:</p>
<pre><code>    Events:
  Type     Reason          Age                   From     Message
  ----     ------          ----                  ----     -------
  Normal   SandboxChanged  47m (x50 over 72m)    kubelet  Pod sandbox changed, it will be killed and re-created.
  Warning  FailedMount     43m                   kubelet  MountVolume.SetUp failed for volume &quot;calico-kube-controllers-token-x&quot; : failed to sync secret cache: timed out waiting for the condition
  Normal   SandboxChanged  3m41s (x78 over 43m)  kubelet  Pod sandbox changed, it will be killed and re-created.
</code></pre>
<p>calico-node-x:</p>
<pre><code>      Warning  Unhealthy       43m (x5 over 43m)      kubelet  Liveness probe failed: calico/node is not ready: Felix is not live: Get &quot;http://localhost:9099/liveness&quot;: dial tcp [::1]:9099: connect: connection refused
  Warning  Unhealthy       14m (x77 over 43m)     kubelet  Readiness probe failed: calico/node is not ready: BIRD is not ready: Error querying BIRD: unable to connect to BIRDv4 socket: dial unix /var/run/bird/bird.ctl: connect: no such file or directory
  Warning  BackOff         4m26s (x115 over 39m)  kubelet  Back-off restarting failed container
</code></pre>
<p>My guess is that there is something wrong with IP/Network config, but did not figure out which.</p>
<ul>
<li>Required ports (k8s&amp;BGP) are forwarded from the router, also tried the master directly connected to the internet</li>
<li>--control-plane-endpoint is a hostname and public resolveable</li>
<li>Calico is using BGP peering (using public ip as peer)</li>
</ul>
<p>This entry does worry me the most:</p>
<ul>
<li>displayes local ip: kubectl get --raw /api</li>
</ul>
<p>I tried to find a way to change this to the public IP of the master, without success.</p>
<p>Anyone got a clue what to try next?</p>

Yakuraku
<p>After an additional time spend with analysis the problem happend to be the distributed api ip address was the local one, not the dns-name.</p>
<p>Created a vpn with wireguard from the cloud node to the local master, so the local ip of the master is reachable from the cloud node.</p>
<p>Don't know if that is the cleanest solution, but it works.</p>
