Submariner
Submariner is open-source, self-hosted networking software that connects Pods and Services across Kubernetes clusters running on premises or in the cloud.
What Submariner is
Submariner is open-source, self-hosted networking software that connects Pods and Services across Kubernetes clusters running on premises or in the cloud. It provides cross-cluster Layer 3 connectivity through encrypted or unencrypted tunnels. Lighthouse supplies DNS discovery for services across connected clusters and implements Kubernetes Multi-Cluster Service APIs. IPsec through Libreswan is the default tunnel, while WireGuard and unencrypted VXLAN are also supported. Globalnet can connect clusters with overlapping CIDR ranges; without it, ServiceCIDR and ClusterCIDR ranges must be distinct. Installation and management use a Kubernetes Operator, with subctl and Helm charts available and subctl recommended in the documentation. The Gateway Engine supports active/passive high availability. Submariner is aimed at teams running applications across clouds, data centers, or regions for geo-redundancy, scale, and fault isolation. Deployment requires administrative setup, including firewall rules. External endpoints and Load Balancer mode are described as experimental.
Good
- Cross-cluster Layer 3 connectivity
- DNS service discovery with Lighthouse
- IPsec, WireGuard, or VXLAN tunnels
- Active/passive gateway high availability
- Open source and self-hosted
Watch out
- Requires firewall and administrative setup
- External connectivity is experimental
- Load Balancer mode is experimental
- Overlapping CIDRs need Globalnet
Who it suits
It suits teams operating multiple Kubernetes clusters across clouds, data centers, or regions. Users should be comfortable with self-hosted deployment and infrastructure administration.
Verdict
Submariner provides a focused way to connect Kubernetes services across clusters, with several tunnel choices and service discovery. It is better suited to experienced infrastructure teams because deployment and some connectivity modes require additional configuration or remain experimental.
The facts
Each one read from Submariner's own pages, with the date it was checked.
What it does
- Administrative requirements
- Deployment requires administrative setup, including configuring firewall rules in the underlying infrastructure.checked 2 Oct 2026
- Audience
- Submariner is aimed at teams operating multiple Kubernetes clusters across clouds, data centers, or regions.checked 3 Oct 2026
- Calico limitation
- Submariner is validated with Calico when it uses VXLAN encapsulation, and Calico requires configuration to avoid NAT on remote cluster subnets.checked 2 Oct 2026
- Community support
- The project offers community help through GitHub, Kubernetes Slack, open community meetings, and user and developer mailing lists.checked 2 Oct 2026
- Connectivity
- It provides cross-cluster Layer 3 connectivity using encrypted or unencrypted connections.checked 2 Oct 2026
- Deployment
- Submariner is installed and managed through a Kubernetes Operator, with subctl and Helm charts as deployment tools; the docs recommend subctl.checked 3 Oct 2026
- Deployment tool
- The project includes subctl, a command-line utility that simplifies deployment and management.checked 2 Oct 2026
- External connectivity
- Access to external applications or endpoints outside Kubernetes is described as experimental and potentially less mature or stable than core features.checked 2 Oct 2026
- High availability
- The Gateway Engine supports active/passive high availability, with standby instances ready to take over if the active instance fails.checked 3 Oct 2026
- License
- Contributions to Submariner projects other than the website must be made available under Apache License 2.0.checked 3 Oct 2026
- Limit
- Load Balancer mode is marked experimental and is not yet tested across all cloud providers or failover scenarios.checked 3 Oct 2026
- Networking
- It provides cross-cluster Layer 3 connectivity using encrypted or unencrypted connections.checked 3 Oct 2026
- Network plugins
- Submariner is designed to be CNI-agnostic and documents working alongside network plugins including Calico and Flannel.checked 2 Oct 2026
- Open source
- The project describes Submariner as completely open source and network-plugin agnostic.checked 3 Oct 2026
- Project status
- Submariner is a Cloud Native Computing Foundation sandbox project.checked 2 Oct 2026
- Purpose
- Submariner connects Pods and Services across Kubernetes clusters on-premises or in the cloud.checked 3 Oct 2026
- Security
- The Broker deployment generates a broker-info.subm file containing an API endpoint, CA certificate, service-account token, and random IPsec pre-shared key.checked 3 Oct 2026
- Service discovery
- Lighthouse provides DNS discovery for Kubernetes clusters connected by Submariner and implements Kubernetes Multi-Cluster Service APIs.checked 3 Oct 2026
- Support
- The project directs users to GitHub, Kubernetes Slack, community meetings, and the submariner-dev and submariner-users mailing lists for help and discussion.checked 3 Oct 2026
- Tunnel options
- The Gateway Engine supports IPsec using Libreswan by default, WireGuard, and unencrypted VXLAN tunnels.checked 3 Oct 2026
- Use case
- It supports applications spanning cloud providers, data centers, and regions for needs such as geo-redundancy, scale, and fault isolation.checked 3 Oct 2026
Where it runs
- Overlapping CIDRs
- Globalnet provides an optional way to connect clusters with overlapping CIDRs; by default, clusters need distinct, non-overlapping ServiceCIDR and ClusterCIDR ranges.checked 3 Oct 2026
Alternatives to Submariner
- 1
Antrea
Free planOpen sourceAPILinuxSelf-hostedWindows7.2Free plan - 2
Network Service Mesh
Free planOpen sourceAPILinuxSelf-hosted7.0Free plan - 3
Aviatrix Kubernetes Firewall
WebSelf-hosted6.2 - 4
kube-network-policies
Free planLinuxSelf-hosted6.2Free plan - 5
Calico Open Source
Free planLinuxSelf-hostedWindows6.1Free plan - 6
Cilium
Free planLinuxSelf-hosted6.0Free plan