hold up, this has nothing to do with the iptables rules

how did you deploy the client?

applying this manifest - https://github.com/gravitl/netmak8s/blob/main/netclient-gateway.yaml

with pertinent modifications, of course

Are you running 0.9.4?

0.12.0

i know, i already made that mistake 😆

so i updated the manifest to use 0.12.0 (which is what i'm using on a VM to run the netmaker server, following the quick install instructions there), and added the correct token to the gateway manifest

Hello guys, we want to deploy the cross cloud k8s cluster in production. Sadly, the

https://itnext.io/how-to-deploy-a-cross-cloud-kubernetes-cluster-with-built-in-disaster-recovery-bbce27fcc9d7

seems depricated a bit. We are expieriencing problems with the cert manager and installing netmaker properly. Tried docker-compose quick start and the preferred way in the doc on itnext, no change, always 404. Looks like the itnext doc is missing a few updates or config steps or whatever. Would be cool if somebody could help us our here, we are a company from Germany so we can pay if u want 😄

Should’ve put that in Netmaker support probably 😇😅

Hi! I've actually been working on updating the tutorials because they are quite old at this point and Netmaker has undergone several changes since then. In the meantime, I would attempt the tutorial but with the latest Netmaker version (0.12.0). Install steps for this are here https://github.com/gravitl/netmaker#get-started-in-5-minutes and here https://docs.netmaker.org/quick-start.html

I think that’s what we tried!

Is the QuickStart compatible with k8s though?

Didn’t try the single command quick start!

And can u tell if the rest of the itNext doc is still working?

i plan to go through that today, but taking a quick look I already see the manifests are out of date, so that is likely the issue

Okay, so indeed it’s jot gonna work whatever we do right now?

it should work as long as you're able to install the netmaker server

my recommendation would actually be to not install it on the cluster you are managing

reason being: it is very difficult to fix if something goes wrong

netmaker controls the underlying networking of the cluster. If Netmaker is also deployed on the cluster and something goes wrong, then it can become unreachable, which becomes a chicken and egg problem

I'm strugging a bit with the docs here. I'm trying to set up netmaker to give remote access to a managed DOKS cluster. The use case is that I want to have external traffic (say, the home website for example) routed via Ambassador edge stack and external IP but also give employees access to internal services when they are connected to the cluster via the wireguard client. I have the 2-node cluster all set up (it's this architecture: ) and then I added netmaker as its own droplet (using the 1 click DO install) not inside the kubernetes cluster but still inside the VPC. I installed the kernel wireguard client daemonset for DOKS you guys provided which was also really nice. Thanks for that. I set up the network that I called k8's as 10.200.0.0/24. From my external client (my home desktop) I can ping the k8s nodes (10.200.0.2, 10.200.0.3) and the netmaker droplet (10.200.0.1) when connected via wireguard client. Netmaker droplet configured as an ingress gateway. All good there. But now I have two issues: 1. DNS doesn't appear to work - if i try to ping one of the default DNS addresses from my external client e.g. netmaker.k8s or cluster-pool-d4z5i.k8s from my external client I get "cannot resolve". Did I miss a step here on the DNS configuration? 2. It's not clear how I expose internal services to the 10.200.0.0 network - can I use externalName for the service and point to the DNS entry that's specified in netmaker e.g. use cluster-pool-d4z5ki.k8s as the externalName? Do I need to configure cilium to use netmaker's interface to do that? 3. Lastly, and this is more of a general security question - netmaker is supposed to function outside of the vpc right? So it's actually not a very good idea to have it currently inside the vpc yet exposed to the net - I should move netmaker droplet out of the vpc, correct?

Hi @User , we're working through the k8s manifests to provide some updated docs. 1. it looks like the issues you are facing are related to DNS problems. A couple of notes: In 0.9.4, DNS only works for machines with resolvectl installed, and even then would sometimes not get added. The easiest way is to manually provide the nameserver. However, you may want to consider using 0.12.1, where DNS is much more stable. 2. Netmaker does not expose dns names from kubernetes clusters automatically, just the egress range (10.200.0.0). You will have endpoints but not dns names. We have an enhancement that can add the service dns names here: https://github.com/gravitl/netmak8s. The "servicex" service will scoops up dns entries from your cluster and add them to Netmaker. However, this also needs to be tested and likely updated for 0.12.1. Also, are you having trouble defining the egress gateway as well? 3. Either way should work, but in general will be much less complicated using netmaker outside the VPC. If it is inside the VPC, for now we recommend turning off udp hole punching because with it on the internal node IP will be propagated to machines outside the VPC, which will be unreachable.

@User thank you for the detailed and thorough response Alex. I will upgrade to 0.12.1, install your recommended enhancement, move Netmaker droplet outside of VPC, and report back

@User ended up doing above, but still having issues with DNS resolution - will move the discussion further into server support channel

Hello! I am trying to setup netmaker(backend/ui/etc) on a single node k3s instance. I have it running but browsing to the dashboard asks me to login and not to create a user on first run. Just wondering if anybody else has tried this on a single node k3s.

I solved it. During testing I had changed the BACKEND_URL to the service name for testing. Switching it back to the tls url gave me the dialog.

How did u even get that far? I'm tryna do the same but k3s hurtz ma brain

Agreed, it doesn't look like the simplest app to deploy. The k8s templates on github didn't work for me of course and they are outdated (I guess?) but still a starting point. I went and looked at the compose file here https://docs.netmaker.org/server-installation.html#compose-file-annotated and just started to port it to k8s manifests piece by piece. If I actually get it to work I can put it on a github somewhere.

Would appreciate a summary if u can manage. I will take a look at those docs and give it another shot