deploy broker,component can not connect apiserver,pod and svc network is down

[13567436138]

[root@kamaji-manager-01-a ~]# kubectl logs -n calico-apiserver calico-apiserver-756f6d854b-lbpcf 
Version:      v3.26.1
Build date:   2023-06-17T00:55:51+0000
Git tag ref:  v3.26.1
Git commit:   b1d192c95
F1108 10:12:08.666649       1 server.go:73] error running server (unable to load configmap based request-header-client-ca-file: Get "https://10.85.0.1:443/api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication": dial tcp 10.85.0.1:443: i/o timeout)
[root@kamaji-manager-01-a ~]# ^C
[root@kamaji-manager-01-a ~]# telnet 10.85.0.1 443
Trying 10.85.0.1...
Connected to 10.85.0.1.
Escape character is '^]'.

I delete default ippool and add a new one

export DATASTORE_TYPE=kubernetes
export KUBECONFIG=~/.kube/kamaji-manager-01

cat << EOF|calicoctl apply -f -
apiVersion: projectcalico.org/v3
kind: IPPool
metadata:
  name: submariner-ippool 
spec:
  cidr: 10.248.0.0/16 
  vxlanMode: Always   
  natOutgoing: false   
  nodeSelector: all()
  blockSize: 26
  allowedUses:
  - Workload
EOF

root@ubuntu:/mnt# subctl --version
subctl version release-0.21

[root@kamaji-manager-01-a ~]# kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"29", GitVersion:"v1.29.1", GitCommit:"bc401b91f2782410b3fb3f9acf43a995c4de90d2", GitTreeState:"archive", BuildDate:"2025-05-25T14:31:26Z", GoVersion:"go1.21.4", Compiler:"gc", Platform:"linux/amd64"}

[13567436138]

I find the reason ,nat is need to set true,because the apiserver using node ip as pod ip,but submariner need nat to be set false.will this be a problem

[13567436138]

do I need to set two ippool,second with set natOutgoing: false

[13567436138]

if I set another ippool with nat false,the pod with this ippool can not use apiserver,this is a problem,
problem still not solved

it seam the only way is remove apiserver hostnetwork and make a svc

[dfarrell07]

Looks like this has been resolved (given your other questions)?