ARTESCA Network Architecture

ARTESCA can integrate with multiple network configurations. However, some initial integration choices cannot be modified post-installation using the standard product tools and procedures.

This section introduces the key concepts of ARTESCA’s services and networks to help you define the appropriate integration during the installation phase.

ARTESCA Reserved IP Ranges

ARTESCA reserves two IP ranges for its internal Kubernetes networking. These ranges must not overlap with any address space already present in your infrastructure to avoid conflicts and system malfunctions.

  • Pod Network: 10.233.0.0/16.

    ARTESCA uses Calico as its CNI plugin, which allocates a virtual interface and an IP from this range to every running container. These addresses exist only within the Kubernetes data plane and never appear on a physical network interface. When pods on different nodes communicate, their traffic traverses the Workload Plane Network interface which is why that network requires substantial bandwidth.

  • Service Network: 10.96.0.0/12.

    Each logical service (such as the S3 endpoint, IAM endpoint, or metadata layer) receives a stable IP from this range. When a workload inside the cluster connects to a service IP, kube-proxy rewrites the destination using iptables DNAT to one of the actual pod IPs in 10.233.0.0/16. Service IPs carry no inter-node traffic of their own. The redirect is applied locally on each node.

Note

You can reconfigure both ranges during the installation using the --pods-cidr and --services-cidr options when generating the configuration file. If either range conflicts with your existing infrastructure, contact Scality Support.

ARTESCA Networks

ARTESCA front-end and internal services communicate over two isolated networks:

  • Management Network (also named Control Plane Network (CP)) for communication among the components managing the cluster.

  • Data Network (also named Workload Plane Network (WP)) for communication among the components managing the data. This network requires substantial bandwidth.

ARTESCA Front-End Services

ARTESCA provides two types of front-end services:

  • Management Services: Management UI and API services are for administering the platform, or accessing S3 / IAM operations. These services are accessible via a management IP address. This is typically used by a person working with the platform.

  • Data Services: S3 API and IAM API. These services are accessible via a hostname, and require (DNS) resolution to the data IPs.

ARTESCA Internal Services

Two types of internal services are provided by ARTESCA:

  • Data processing services like data protection, replication, and lifecycle mechanisms

  • Cluster management, and self-healing services

Network Configuration

  • Overview

Communications can be established in the following ways:

  • Over a single physical network (Single Network)

  • In a segregated manner (Management and Data Networks) over two networks via:

    • Two physical network interfaces

    • One physical network interface with VLAN tagging

Refer to Installation Summary for more information.

The segregated approach is recommended if there are security requirements to separate platform administration and data usage operations, or if users want to separate internal services from external services.

The management and data (CP and WP) networks must be defined during the installation of ARTESCA by specifying their respective network ranges in CIDR format.

  • Virtual Appliance

For the virtual appliance, communications are established over a single network interface card (Single Network). This network is used for both :

  • management (also named Control Plane - CP)

  • data (also named Workload Plane - WP) traffic

  • Hardware Appliance

ARTESCA’s services communicate over a preconfigured backend network. This backend network is a private network between the nodes of the cluster, and is not accessible from outside the system.

  • Reconfiguring

During installation, the network interfaces corresponding to management and data (CP and WP) network ranges are automatically associated with these networks.

Warning

After this step, it is not possible to change the node IP address of this interface without a complete reinstallation of ARTESCA. Except for the virtual appliance, you do have the ability to add a new interface to your virtual machine and change the listening IP for the Data and/or Management Services.

  • Adaptability

In all cases, you are encouraged to define your network configuration in advance to meet your needs.

Access to Front-End Services

  • Overview

The ARTESCA front-end Management Service:

  • Is exposed on the Management Network on TCP port 8443.

  • Can be exposed on one Virtual IP managed by ARTESCA using the procedure Change Management IP.

The ARTESCA front-end Data Service:

  • Is exposed on the Data Network on TCP port 443 (optionally on TCP port 80).

  • Can be exposed on several Virtual IPs managed by ARTESCA using the procedure Change Data Listening IP.

Note

If you use an external load balancer, you don’t need this configuration.

Refer to High Availability for more information.

The OS Reconfiguration procedure allows you to reconfigure your front-end interfaces (IP, Bonding, VLAN tagging).

The Change Management IP procedure allows you to expose the management services on an IP and optionally on one Virtual IP. Refer to High Availability for more information.

The Change Data Listening IP procedure allows you to expose the S3 and IAM services on IPs and optionally on Virtual IPs. Refer to High Availability for more information.

The Change ARTESCA Subdomain procedure allows you to change the domain name suffix of the ARTESCA S3 service.

  • Hardware Appliance

In the case of the hardware appliance, dedicated network interfaces simplify the integration of ARTESCA into your network.

Front-end communications can be established in the following ways:

  • Over a single physical network (Single Network)

  • In a segregated manner (management and data networks) over two networks via:

    • Two physical network interfaces

    • One physical network interface with VLAN tagging

Refer to Installation Summary for more information.

The segregated approach is recommended if there are security requirements to separate platform administration and data usage operations, or if users want to separate internal services from external ones.

Default Gateway Setup

ARTESCA supports the configuration of only one default gateway. Therefore, in case of segregated management and data networks with strong requirements for securing platform management, the default gateway is the preferred set up on the data network. Platform management requests will come from the client within the management network (LAN).

In the case you want to access segregated CP and WP networks from two distinct remote networks, contact Scality to configure ARTESCA appropriately.

Refer to Change Default Gateway to change the default gateway from the CP Network Interface to the WP Network Interface.

High Availability

ARTESCA ensures high availability of both:

  • The management services via the procedure Change Management IP using one Virtual IP.

  • The data management services via the procedure Change Data Listening IP, using several Virtual IPs. Scality recommends you use as many Virtual IPs as there are nodes.

You have the option to ensure high availability of the solution by configuring an external load balancer for data services. Refer to the Configure Data Load Balancer documentation for more information.

ARTESCA is set by default to terminate SSL connections. If you wish to terminate SSL connections on your external load balancer, please contact Scality support.