EVPN

Your pod is Running, your Service exists, the curl still hangs. Most Kubernetes traffic diagrams stop at a Load Balancer cloud. On bare metal that cloud is a Cisco Nexus EVPN fabric. Here is one HTTPS request traced all the way to the pod, with the command that proves every hop.

A MAC address leaves a Cisco datacenter and reappears behind a Juniper leaf in another one. Watch RFC 7432 do its job across the multisite DCI: the counter climbing 0, 1, 2, the losing leaf yielding, and the exact BGP packets that carried each move, captured on the interconnect.

Type-2 gets all the attention, but a datacenter fabric runs on five core EVPN route types and quietly depends on every one. Here is what each actually carries, decoded from a live multihomed fabric, including the two types MLAG labs never get to show you.

A traceroute between two datacenters comes back as six lines. Each one is a precise statement about what a multisite EVPN-VXLAN fabric does to a packet: the anycast gateway, the VXLAN wrap and unwrap, numbered versus unnumbered routers, the crossing between sites. All six, decoded on the boxes.

Anycast usually lets the network decide which datacenter answers. I moved that decision onto two GoBGP hosts that watch both datacenters and steer a single global VIP between them. Here's the design, the traffic flow, and three failover drills that came through with zero failed requests.

One HTTPS request followed from an external client to a pod, with the show commands and packet captures from every device it touches: BGP unnumbered underlay, type-2, type-3 and type-5 EVPN routes, symmetric routing proven on the wire, a Palo Alto A/A pair and Cilium.