ARTESCA Network Architecture

This section introduces the key concepts of ARTESCA’s networks and services to help you define the appropriate integration during the installation phase.

ARTESCA Reserved IP Ranges

ARTESCA reserves two IP ranges for its internal Kubernetes networking. These ranges must not overlap with any address space already present in your infrastructure to avoid conflicts and system malfunctions.

  • Pod Network: 10.233.0.0/16.

    ARTESCA uses Calico as its CNI plugin, which allocates a virtual interface and an IP from this range to every running container. These addresses are internal to the ARTESCA cluster and are never routed outside of it. When pods on different nodes communicate, their traffic traverses the Workload Plane Network interface, which is why that network requires substantial bandwidth.

  • Service Network: 10.96.0.0/12.

    Each logical service (such as the S3 endpoint, IAM endpoint, or metadata layer) receives a stable IP from this range. When a workload inside the cluster connects to a service IP, kube-proxy rewrites the destination using iptables DNAT to one of the actual pod IPs in 10.233.0.0/16. Service IPs carry no inter-node traffic of their own. The redirect is applied locally on each node.

Note

You can reconfigure both ranges during the installation using the --pods-cidr and --services-cidr options when generating the configuration file. If either range conflicts with your existing infrastructure, you can replace it with any other range, down to a /20 subnet.

ARTESCA Networks

ARTESCA relies on two networks for the communications internal to the cluster:

  • The Control Plane Network carries Kubernetes orchestration and internal cluster communications.

  • The Workload Plane Network carries application data traffic between the nodes, including the internal services that ARTESCA runs on your behalf such as data protection, replication, lifecycle transitions, and cluster self-healing. Because these services generate traffic in addition to the client traffic, this network requires substantial bandwidth.

ARTESCA Front-End Services

ARTESCA provides two front-end services:

  • Management Service: the management UI and API, used to administer the platform and to perform S3/IAM administrative operations. Platform administrators are the usual consumers of this service. By default, the Management Service is exposed on the Control Plane Network and on TCP port 8443.

  • Data Service: the S3 API and IAM API. Clients reach this service through a hostname, which requires DNS resolution to the data IPs. By default, the Data Service is exposed on the Workload Plane Network and on TCP port 443 (optionally on TCP port 80).

Both services can, however, be exposed on any network. You choose where each one is exposed at installation time, and you can change it at any point afterwards:

Continue with Configure the ARTESCA Network to set up these networks during installation.