Explain Sjunet ingress capabilities and work to be done for customers

[llarsson]

Describe the bug

This page doesn't clearly state what is supported over the VPN connection:

• Can the Sjunet side of this setup initiate connections to services running in Compliant Kubernetes, at all, on an IP address level? As in, not just responding to requests from Compliant Kubernetes, but actually initiate ones themselves?
• Can they do it on Sjunet-internal IP address ranges?
• If yes to the above, can they somehow look up domain names services there, and if not (which I assume would be the case), let's make sure to give detailed information about what would a Customer have to do to expose an Ingress on a Sjunet-internal IP address.

[cristiklein]

@llarsson These are very relevant questions. However, how much should we educate Application Developers about Sjunet vs how much should we simply point them to Sjunet documentation, as we currently do?

Note that, Sjunet is not self-service. This is a feature, not a bug. Sjunet access is a privilege, not a right. Sjunet sets contractual requirements to those who want to be part of it. In fact, Sjunet access has two parts:

• Del 1 - teckna abonnemang
• Del 2 - beställ teknisk anslutning

I believe that Application Developers should get the answers to the questions you posted above in "Del 2".

I feel like we should close this issue by adding a disclaimer like "we are not Sjunet, for Sjunet questions, please contact Sjunet".

What do you think?

P.S. To not leave you completely in the dark, I speculate that Sjunet essentially gives each subscriber an IP address in the Sjunet range. Application Developers must configure the VPN VM to do SNAT for outbound, i.e., CK8s-to-Sjunet connections.

I also speculate that Application Developers could configure DNAT to receive Sjunet-to-CK8s connections. However, I'm ignorant on whether such usage is allowed or encourage in Sjunet.

However, since the VPN VM is outside our area of configuration, I can really only speculate.

[llarsson]

I just want developers to have a good experience. ;)

I agree that we don't know what they set up, and we are not responsible for that, but we are the ones that would potentially have to run an Ingress Controller for them so they can get traffic from Sjunet into their cluster, exposed on the network where the VM sits.

How about this: if someone asks, we pinky promise to be very informative, and make that information available here and not just in a ticket? 😄

[cristiklein]

How about this: if someone asks, we pinky promise to be very informative, and make that information available here and not just in a ticket? 😄

Deal! 😄