<p>First, etcd is a core component in Kubernetes clusters. It is based on the <a href="https://raft.github.io/" rel="nofollow noreferrer">Raft Consensus Algorithm</a> and a <strong>weaker point</strong> with it is when the latency between the members (e.g. in the distribued etcd database) in the cluster is <em>larger</em> and <em>vary more</em>. It might work to deploy it with longer latency between the nodes (e.g. regions as in cross-region) but it might not be the best idea, at least not out of the box.</p>
<p>But if you use cross-region deployments, one of the main reason to do it is probably to tolerate a full region outage - but then I think it is even a better idea to deploy independent (e.g. can work without the other) clusters.</p>
<p>What might be interesting in relation to this is <a href="https://kubernetes.io/blog/2018/12/12/kubernetes-federation-evolution/" rel="nofollow noreferrer">Kubernetes Federation Evolution</a> and <a href="https://github.com/kubernetes-sigs/kubefed" rel="nofollow noreferrer">kubefed</a>.</p>
<p>I don't see VPN (e.g. a single network?) very related to this (this is more its own topic) - at least not when you want independent clusters. SSL/TLS might also be related. And if you do cross-regions, e.g. Software Defined Network or cloud VPC might be related as well. E.g. <a href="https://aws.amazon.com/vpc/" rel="nofollow noreferrer">Amazon VPC</a> is located on a single region, but <a href="https://cloud.google.com/vpc" rel="nofollow noreferrer">Google Cloud VPC</a> is global (multi-region).</p>

CC BY-SA 4.0
2021-01-21T18:52:30.627Z
2021-01-21T18:52:30.627Z
Jonas
<p>Given you are going to overcome risks of a whole cloud region going offline, you would implement some cross-site distribution mechanisms.</p>
<p>In terms of Kubernetes, cluster communication would happen across public network.</p>
<p>Therefore, probably, you need to setup end to end VPN connections?</p>
<p>Does this all make sense or how do you approach the problem?</p>

<kubernetes><sre><vpn>
Is cross-region Kubernetes a thing, and if so, what role does VPN place in this context?
Ta Mu
# Is cross-region Kubernetes a thing, and if so, what role does VPN place in this context?

(Asked by: username_0 on 2021-01-21)

Given you are going to overcome risks of a whole cloud region going offline, you would implement some cross-site distribution mechanisms.

In terms of Kubernetes, cluster communication would happen across public network.

Therefore, probably, you need to setup end to end VPN connections?

Does this all make sense or how do you approach the problem?

**Tags:** kubernetes, sre, vpn


---

## 1 answers

### Answer by username_1 on 2021-01-21. Score: 3

First, etcd is a core component in Kubernetes clusters. It is based on the [Raft Consensus Algorithm](https://raft.github.io/) and a **weaker point** with it is when the latency between the members (e.g. in the distribued etcd database) in the cluster is *larger* and *vary more*. It might work to deploy it with longer latency between the nodes (e.g. regions as in cross-region) but it might not be the best idea, at least not out of the box.

But if you use cross-region deployments, one of the main reason to do it is probably to tolerate a full region outage - but then I think it is even a better idea to deploy independent (e.g. can work without the other) clusters.

What might be interesting in relation to this is [Kubernetes Federation Evolution](https://kubernetes.io/blog/2018/12/12/kubernetes-federation-evolution/) and [kubefed](https://github.com/kubernetes-sigs/kubefed).

I don't see VPN (e.g. a single network?) very related to this (this is more its own topic) - at least not when you want independent clusters. SSL/TLS might also be related. And if you do cross-regions, e.g. Software Defined Network or cloud VPC might be related as well. E.g. [Amazon VPC](https://aws.amazon.com/vpc/) is located on a single region, but [Google Cloud VPC](https://cloud.google.com/vpc) is global (multi-region).


---

