<p>I'm trying get a Kubernetes cluster working with some nodes working behind NAT without public IP address. (Why i need it is a different story)</p>

<p>There are 3 nodes:</p>

<ol>
<li>Kubernetes cluster master (with public IP address)</li>
<li>Node1 (with public IP address)</li>
<li>Node2 (works behind NAT on my laptop as a VM, no public IP address)</li>
</ol>

<p>All 3 nodes are running Ubuntu 18.04 with Kubernetes v1.10.2(3), Docker 17.12</p>

<p>Kubernetes cluster was created like this:</p>

<p><code>kubeadm init --pod-network-cidr=10.244.0.0/16</code></p>

<p>Flannel network is used:</p>

<p><code>kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml</code></p>

<p>Node1 and Node2 joined the cluster:</p>

<p><code>NAME                  STATUS    ROLES     AGE       VERSION
master-node              Ready     master    3h        v1.10.2
node1                    Ready     &lt;none&gt;    2h        v1.10.3
node2                    Ready     &lt;none&gt;    2h        v1.10.2</code></p>

<p>Nginx deployment + service (type=NodePort) created and scheduled for the Node1 (with public IP):</p>

<p><a href="https://pastebin.com/6CrugunB" rel="noreferrer">https://pastebin.com/6CrugunB</a></p>

<p><code>kubectl get svc
NAME               TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
kubernetes         ClusterIP   10.96.0.1        &lt;none&gt;        443/TCP        3h
my-nginx           NodePort    10.110.202.32    &lt;none&gt;        80:31742/TCP   16m
</code></p>

<p>This deployment is accessible through <a href="http://MASTER_NODE_PUBLIC_IP:31742" rel="noreferrer">http://MASTER_NODE_PUBLIC_IP:31742</a> and <a href="http://NODE1_PUBLIC_IP:31742" rel="noreferrer">http://NODE1_PUBLIC_IP:31742</a> as expected.</p>

<p>Another Nginx deployment + service (type=NodePort) created and scheduled for the Node2 (without public IP):</p>

<p><a href="https://pastebin.com/AFK42UNW" rel="noreferrer">https://pastebin.com/AFK42UNW</a></p>

<p><code>kubectl get svc
NAME               TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
kubernetes         ClusterIP   10.96.0.1        &lt;none&gt;        443/TCP        3h
my-nginx           NodePort    10.110.202.32    &lt;none&gt;        80:31742/TCP   22m
nginx-behind-nat   NodePort    10.105.242.178   &lt;none&gt;        80:32350/TCP   22m</code></p>

<p>However this service is not accessible through <a href="http://MASTER_NODE_PUBLIC_IP:32350" rel="noreferrer">http://MASTER_NODE_PUBLIC_IP:32350</a> nor <a href="http://NODE1_PUBLIC_IP:32350" rel="noreferrer">http://NODE1_PUBLIC_IP:32350</a>.</p>

<p>It is only accessible through <a href="http://MY_VM_IP:32350" rel="noreferrer">http://MY_VM_IP:32350</a> from my laptop.</p>

<p>Moreover: i can not get inside the <code>nginx-behind-nat</code> pods via <code>kubectl exec</code> either.</p>

<p>Is there any way to achieve it?</p>

mennanov
<p>As mentioned in the Kubernetes <a href="https://kubernetes.io/docs/concepts/cluster-administration/networking/" rel="nofollow noreferrer">documentation</a>:</p>

<blockquote>
  <p>Kubernetes imposes the following fundamental requirements on any
  networking implementation (barring any intentional network
  segmentation policies):</p>
  
  <ul>
  <li>all containers can communicate with all other containers without NAT</li>
  <li>all nodes can communicate with all containers (and vice-versa) without NAT</li>
  <li>the IP that a container sees itself as is the same IP that others see it as</li>
  </ul>
  
  <p>What this means in practice is that you can not just take two
  computers running Docker and expect Kubernetes to work. You must
  ensure that the fundamental requirements are met.</p>
</blockquote>

<p>By default, the connections from api-server to a node, port or service are just plain HTTP without authentication and encryption.<br>
They can work over HTTPS, but by default, apiserver will not validate the HTTPS endpoint certificate, and therefore, it will not provide any guarantees of integrity and could be subject to man-in-the-middle attacks.</p>

<p>For details about securing connections inside the cluster, please check this <a href="https://kubernetes.io/docs/concepts/architecture/master-node-communication/" rel="nofollow noreferrer">document</a></p>
