K3’s network architecture using draw.io

The network architecture of my k3s cluster explains how traffic from outside is routed to the correct pod. Three nodes, an external Nginx reverse proxy, and Traefik disabled in favour of a custom ingress flow.

Ingress flow

Incoming traffic always goes via the external Nginx proxy — which is located outside the cluster and does not recognise any internal IP addresses in the browser.

Namespaces

Each application is assigned its own namespace — this simplifies resource quotas and network policies.

Nginx configuration pattern

upstream k3s {
    server 10.0.0.11:80;
    server 10.0.0.12:80;
    server 10.0.0.13:80;
}

server {
    server_name *.siekman.io;
    location / {
    proxy_pass http://k3s;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    }
}