Freedom251 › Container Networking Software

Submariner

Free plan Self-hosted

What Submariner is

Submariner connects Pods and Services between Kubernetes clusters running in clouds or on premises. It provides cross-cluster Layer 3 networking with encrypted or unencrypted connections, while Lighthouse supplies DNS discovery and Kubernetes Multi-Cluster Service APIs across linked clusters. The project is self-hosted, open source, and designed to work with different network plugins, including Calico and Flannel. IPsec through Libreswan is the default encryption option; WireGuard and unencrypted VXLAN tunnels are also supported. Globalnet can optionally connect clusters with overlapping CIDR ranges, while standard deployments require distinct ServiceCIDR and ClusterCIDR ranges. Installation and management use a Kubernetes Operator, with subctl and Helm charts available. The Gateway Engine supports active/passive high availability. Submariner targets teams running applications across clouds, data centers, or regions, and it is free to use. Deployment still requires administrative setup, including firewall configuration.

Who it suits

Submariner suits teams operating multiple Kubernetes clusters across clouds, data centers, or regions. It is intended for applications needing cross-cluster connectivity, geo-redundancy, scale, or fault isolation.

What it does well

Cross-cluster Layer 3 connectivity
Lighthouse provides multi-cluster DNS discovery
Supports IPsec, WireGuard, and VXLAN
Active/passive gateway high availability
Open source and self-hosted

What to know first

Requires administrative firewall configuration
External endpoint access is experimental
Load Balancer mode is experimental
Overlapping CIDRs need optional Globalnet

Getting started

Prepare the Kubernetes clusters and their underlying firewall rules
Install Submariner through its Kubernetes Operator
Use subctl for deployment and management, or apply the Helm charts
Choose IPsec, WireGuard, or unencrypted VXLAN tunnel settings
Configure Globalnet if cluster CIDR ranges overlap
Connect the clusters and enable Lighthouse service discovery

Verdict

Submariner provides a free, self-hosted way to link Kubernetes services across clusters, with several tunnel choices and service discovery. Teams should account for network administration and the experimental status of external connectivity and Load Balancer mode.

Questions

Is Submariner free?

Yes. Submariner is offered as free software with a free plan.

Where can Submariner run?

It is self-hosted on Kubernetes environments, including OpenShift-SDN, Weave, Flannel, Canal, Calico, OVN, AWS, GKE, and Azure.

Does it encrypt traffic?

Yes. IPsec through Libreswan is the default encryption method; WireGuard and unencrypted VXLAN are also supported.

Can it connect clusters with overlapping CIDRs?

Yes, through the optional Globalnet component. The default configuration requires distinct ServiceCIDR and ClusterCIDR ranges.

How is Submariner deployed?

A Kubernetes Operator manages installation, with subctl and Helm charts available. The documentation recommends subctl.

Where can users get help?

Community support is available through GitHub, Kubernetes Slack, open community meetings, and the submariner-dev and submariner-users mailing lists.

Facts from Submariner's own pages

Administrative requirements: Deployment requires administrative setup, including configuring firewall rules in the underlying infrastructure. · submariner.io, 2 Oct 2026
Audience: Submariner is aimed at teams operating multiple Kubernetes clusters across clouds, data centers, or regions. · submariner.io, 3 Oct 2026
Calico limitation: Submariner is validated with Calico when it uses VXLAN encapsulation, and Calico requires configuration to avoid NAT on remote cluster subnets. · submariner.io, 2 Oct 2026
Community support: The project offers community help through GitHub, Kubernetes Slack, open community meetings, and user and developer mailing lists. · submariner.io, 2 Oct 2026
Connectivity: It provides cross-cluster Layer 3 connectivity using encrypted or unencrypted connections. · submariner.io, 2 Oct 2026
Deployment: Submariner is installed and managed through a Kubernetes Operator, with subctl and Helm charts as deployment tools; the docs recommend subctl. · submariner.io, 3 Oct 2026
Deployment tool: The project includes subctl, a command-line utility that simplifies deployment and management. · submariner.io, 2 Oct 2026
External connectivity: Access to external applications or endpoints outside Kubernetes is described as experimental and potentially less mature or stable than core features. · submariner.io, 2 Oct 2026
High availability: The Gateway Engine supports active/passive high availability, with standby instances ready to take over if the active instance fails. · submariner.io, 3 Oct 2026
License: Contributions to Submariner projects other than the website must be made available under Apache License 2.0. · submariner.io, 3 Oct 2026
Limit: Load Balancer mode is marked experimental and is not yet tested across all cloud providers or failover scenarios. · submariner.io, 3 Oct 2026
Networking: It provides cross-cluster Layer 3 connectivity using encrypted or unencrypted connections. · submariner.io, 3 Oct 2026
Network plugins: Submariner is designed to be CNI-agnostic and documents working alongside network plugins including Calico and Flannel. · submariner.io, 2 Oct 2026
Open source: The project describes Submariner as completely open source and network-plugin agnostic. · submariner.io, 3 Oct 2026
Overlapping CIDRs: Globalnet provides an optional way to connect clusters with overlapping CIDRs; by default, clusters need distinct, non-overlapping ServiceCIDR and ClusterCIDR ranges. · submariner.io, 3 Oct 2026
Project status: Submariner is a Cloud Native Computing Foundation sandbox project. · submariner.io, 2 Oct 2026
Purpose: Submariner connects Pods and Services across Kubernetes clusters on-premises or in the cloud. · submariner.io, 3 Oct 2026
Security: The Broker deployment generates a broker-info.subm file containing an API endpoint, CA certificate, service-account token, and random IPsec pre-shared key. · submariner.io, 3 Oct 2026
Service discovery: Lighthouse provides DNS discovery for Kubernetes clusters connected by Submariner and implements Kubernetes Multi-Cluster Service APIs. · submariner.io, 3 Oct 2026
Support: The project directs users to GitHub, Kubernetes Slack, community meetings, and the submariner-dev and submariner-users mailing lists for help and discussion. · submariner.io, 3 Oct 2026
Tunnel options: The Gateway Engine supports IPsec using Libreswan by default, WireGuard, and unencrypted VXLAN tunnels. · submariner.io, 3 Oct 2026
Use case: It supports applications spanning cloud providers, data centers, and regions for needs such as geo-redundancy, scale, and fault isolation. · submariner.io, 3 Oct 2026

Where Submariner stands on Freedom251

Container Networking Software#20 of 28