Quartz 5

Kubernetes Networking: A Deep Dive

Properties1
tagskubernetes, devops, networking

2 min read

Summary

A comprehensive reference guide to Kubernetes networking covering all five communication types, CNI plugins, DNS, Network Policies, and end-to-end traffic flow — written as CKA/CKAD exam preparation material. The guide walks from the fundamental flat-network model (every Pod gets a unique IP, no NAT between Pods) through the full stack: veth pairs, cni0 bridge, CNI overlays (VXLAN/IPIP), kube-proxy (iptables vs IPVS), Services (ClusterIP/NodePort/LoadBalancer), Ingress, Gateway API, CoreDNS, and NetworkPolicies.

涵蓋 Kubernetes 五種網路通訊類型、CNI 外掛、DNS、網路策略與端到端流量的完整參考指南，適合 CKA/CKAD 備考。從扁平網路模型（每個 Pod 有唯一 IP，Pod 間無 NAT）延伸至 veth pair、CNI overlay、kube-proxy、Service、Ingress、CoreDNS、NetworkPolicy 的完整堆疊。

Key Points

  • Three K8s networking principles: Pod-to-Pod without NAT, Node-to-Pod without NAT, Pod IP consistency (self-IP = externally-visible IP)
  • Five communication types: Container-to-Container (shared network namespace, localhost), Pod-to-Pod (veth pair + cni0 bridge + overlay), Pod-to-Service (ClusterIP via kube-proxy DNAT), External-to-Service (NodePort/LoadBalancer/Ingress), Pod-to-External (egress with NAT masquerade)
  • kube-proxy modes: iptables (sequential rules, legacy, default in many setups), IPVS (kernel-level L4 load balancer, better at scale), userspace (legacy)
  • CNI overlay (VXLAN/IPIP): encapsulates Pod IPs in node IPs for cross-node traffic; CNI flat: direct VPC routing, no encapsulation, better performance
  • Ingress API is feature-frozen; innovation happening in Gateway API (GatewayClass + Gateway + HTTPRoute resources)
  • NetworkPolicies operate at L3/L4 (IP + port), not L7; CNI plugin enforces them; default is allow-all

Insights

The Ingress API feature-freeze in favor of Gateway API is an important migration signal often missed in operational documentation. The CNI selection by cluster size (Flannel <50 nodes, Calico/Cilium 50-500, Cilium multi-cloud >500) provides a practical decision heuristic. The cloud-managed CNI section (AWS VPC CNI, Azure CNI, GCP VPC-Native) is relevant for anyone using managed K8s — these eliminate the overlay encapsulation overhead by using real VPC IPs for Pods.

Connections

Raw Excerpt

Kubernetes enforces three foundational networking principles: Every Pod can communicate directly with any other Pod across nodes, without NAT. Nodes can reach every Pod, and Pods can reach nodes, also without NAT. A Pod’s self-IP is identical to what other Pods see externally.

Graph View

Backlinks