Submariner review
A free open-source layer for connecting Pods and Services across Kubernetes clusters.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Submariner is an open-source networking project for teams operating multiple Kubernetes clusters across on-premises environments, public clouds, or hybrid infrastructure. It connects Pods and Services with cross-cluster Layer 3 networking and adds service discovery through Lighthouse. The project fits deployments built for scale, geo-redundancy, fault isolation, or hybrid infrastructure, especially where clusters need direct workload and service connectivity without adopting a broader commercial networking platform.
Its ecosystem fit is a central strength. Submariner documents compatibility with Kubernetes network policies while stating that it does not provide explicit support for NetworkPolicy objects. It is designed to work with Kubernetes environments using OpenShift-SDN, Weave, Flannel, Canal, Calico, or OVN, and across AWS, GKE, Azure, GCP, vSphere, and OpenStack. Deployment and management are handled through the Submariner Operator, with subctl or Helm available for installation and administration. This makes it suitable for teams already managing their own Kubernetes infrastructure and selecting their own underlying network stack.
The feature set is focused on multi-cluster connectivity rather than general cluster networking. Encrypted tunnels use IPsec or WireGuard, while optional VXLAN tunnels are unencrypted. Globalnet addresses overlapping cluster CIDRs, and global egress can assign egress IPs to clusters, namespaces, or selected Pods. Gateway Engine high availability adds active/passive failover. Choose Submariner when free, self-hosted cross-cluster connectivity and service discovery are the priority. Choose another option when you need a general CNI, explicit NetworkPolicy support, or a managed commercial service.
Submariner pros and cons
- Where it wins
- Cross-cluster Pod and Service connectivity with Lighthouse discovery
- IPsec or WireGuard encryption, plus Globalnet for overlapping CIDRs
- Gateway high availability with active/passive failover
- Where it doesn't
- Delivered as self-hosted open-source software
- Does not provide explicit support for NetworkPolicy objects
- Optional VXLAN tunnels are unencrypted
Submariner fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update