<p>I'm trying to deploy Kubernetes with Calico (IPIP) with Kubeadm. After deployment is done I'm deploying Calico using these manifests</p>

<pre><code>kubectl apply -f https://docs.projectcalico.org/v3.3/getting-started/kubernetes/installation/hosted/rbac-kdd.yaml
kubectl apply -f https://docs.projectcalico.org/v3.3/getting-started/kubernetes/installation/hosted/kubernetes-datastore/calico-networking/1.7/calico.yaml
</code></pre>

<p>Before applying it, I'm editing CALICO_IPV4POOL_CIDR and setting it to 10.250.0.0/17 as well as using command <code>kubeadm init --pod-cidr 10.250.0.0/17</code>.</p>

<p>After few seconds CoreDNS pods (for example getting addr 10.250.2.2) starts restarting with error 10.250.2.2:8080 connection refused.</p>

<p>Now a bit of digging:</p>

<p>from any node in cluster <code>ping 10.250.2.2</code> works and it reaches pod (tcpdump in pod net namespace shows it).</p>

<p>from different pod (on different node) <code>curl 10.250.2.2:8080</code> works well</p>

<p>from any node to <code>curl 10.250.2.2:8080</code> fails with connection refused</p>

<p>Because it's coredns pod it listens on 53 both udp and tcp, so I've tried netcat from nodes</p>

<p><code>nc 10.250.2.2 53</code> - connection refused
<code>nc -u 10.250.2.2 55</code> - works</p>

<p>Now I've tcpdump each interface on source node for port 8080 and curl to CoreDNS pod doesn't even seem to leave node... sooo iptables?</p>

<p>I've also tried weave, canal and flannel, all seem to have same issue.</p>

<p>I've ran out of ideas by now...any pointers please?</p>

inc0
<p>Seems to be a problem with Calico implementation, CoreDNS Pods are sensitive on the CNI network Pods successful functioning.
For proper <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#cni" rel="nofollow noreferrer">CNI</a> network plugin implementation you have to include <code>--pod-network-cidr</code> flag to <code>kubeadm init</code> command and afterwards apply the same value to <code>CALICO_IPV4POOL_CIDR</code> parameter inside <code>calico.yml</code>.</p>

<p>Moreover, for a successful Pod network installation you have to apply some <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> rules in order to make sufficient permissions in compliance with general cluster security restrictions, as described in official Kubernetes <a href="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#pod-network" rel="nofollow noreferrer">documentation</a>:</p>

<blockquote>
  <p>For Calico to work correctly, you need to pass
  --pod-network-cidr=192.168.0.0/16 to kubeadm init or update the calico.yml file to match your Pod network. Note that Calico works on
  amd64 only.</p>
</blockquote>

<pre><code>kubectl apply -f https://docs.projectcalico.org/v3.3/getting-started/kubernetes/installation/hosted/rbac-kdd.yaml
kubectl apply -f https://docs.projectcalico.org/v3.3/getting-started/kubernetes/installation/hosted/kubernetes-datastore/calico-networking/1.7/calico.yaml
</code></pre>

<p>In your case I would switched to the latest Calico versions at least from <code>v3.3</code> as given in the example.</p>

<p>If you've noticed that you run Pod network plugin installation properly, please take a chance and update the question with your current environment setup and Kubernetes components versions with a health statuses.</p>
