Proxy Service: A New Network Traffic Abstraction in Kubernetes
summary
Proposes a gRPC-based proxy service to replace SSH tunnels so kube-apiserver can reliably reach cluster endpoints; implements HTTP CONNECT plus gRPC bidirectional streams, mTLS, and an agent-initiated reverse tunnel that the agent opens to the proxy. Streams are multiplexed with data/control packets, support resumable connections after reconnect, and allow load balancing, auditing, multi-network and per-service routing. Configuration lives in a YAML connectivity service object loaded by kube-apiserver; reference implementation and code are on GitHub.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:30Agenda
- 3:33SSH Tunnels
- 4:48API Server
- 6:07Demo
- 7:08Technical details
- 15:27Reference implementation
- 17:18Question
- 19:21Network Context
- 21:06Future Possibilities
- 25:27Contribute
related talks
28mProxy Service: A New Network Traffic Abstraction in Kubernetes
30mA Developer’s Introduction to Service Mesh
29mWhy We Ditched Kube-proxy: Scaling 10M Daily Browser Sessions With Kubernetes Endpoi...
30mgRPC & Kubernetes
15mSimplify Kubernetes Connectivity
31mIntro: Telepresence
21mProduction-Ready gRPC: How Service Meshes Simplify Security, Routing, and Observability
25mApplication Networking on Kubernetes, where are we now?