Kubernetes Networking

Kubernetes Network Model

Kubernetes implements a flat network model where every pod can communicate with every other pod without Network Address Translation (NAT). This simplifies networking but requires proper configuration.

Why this matters: Container networking is complex. Kubernetes abstracts this complexity by providing a consistent network model, enabling predictable service-to-service communication regardless of where pods run.

Network Architecture

graph TD
    A["Pod Network"] -->B["Every Pod
Unique IP"]
    B -->C["Pod-to-Pod
Direct Communication"]
    A -->D["Service Network
Virtual IPs"]
    D -->E["Service DNS
Name Resolution"]
    C -->C1["No NAT
Default"]
    
    style B fill:#e1f5ff
    style D fill:#fff3e0

Pod Networking

Pod IP Assignment

Each pod receives a unique IP address across the cluster. Containers within a pod share the network namespace (localhost communication).

# View pod IPs
kubectl get pods -o wide
# Shows INTERNAL-IP for each pod

Container Networking in Pod

Containers in same pod communicate via localhost:

apiVersion: v1
kind: Pod
metadata:
  name: multi-container
spec:
  containers:
  - name: app
    image: myapp:latest
    ports:
    - containerPort: 8080
  
  - name: sidecar
    image: sidecar:latest
    ports:
    - containerPort: 9000

From app container: curl localhost:9000 reaches sidecar.

Service Networking

Services provide stable DNS names and IP addresses that load balance across pods.

ClusterIP Service

Internal service with stable cluster IP:

apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  selector:
    app: api
  ports:
  - port: 80
    targetPort: 8080
  clusterIP: 10.0.0.10  # Stable IP

DNS resolves to ClusterIP:

# Query DNS from pod
nslookup api
# Address: 10.0.0.10

# Traffic to api:80 load balances across api pods on port 8080

Endpoint Tracking

Services automatically track pod IPs via Endpoints:

kubectl get endpoints api

# NAME   ENDPOINTS
# api    10.0.1.5:8080, 10.0.2.3:8080, 10.0.3.1:8080

# Endpoints update automatically when pods are added/removed

Network Policies

By default, all pods can communicate with all pods. NetworkPolicies enforce ingress/egress restrictions.

Why NetworkPolicies matter: Production security requires isolation. NetworkPolicies prevent unauthorized pod-to-pod communication.

Deny All Ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}  # All pods
  policyTypes:
  - Ingress

No ingress traffic allowed to any pod.

Allow Specific Ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-traffic
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: web
    ports:
    - protocol: TCP
      port: 8080

Only web pods can send traffic to api pods on port 8080.

Egress Control

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
spec:
  podSelector:
    matchLabels:
      app: app
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: dns
    ports:
    - protocol: UDP
      port: 53

Allow app pods to query DNS only.

CNI Plugins

Kubernetes doesn't implement networking itself. Container Network Interface (CNI) plugins implement pod networking.

Popular CNI Plugins

Why CNI plugins: Different deployments have different networking requirements (performance, security, complexity).

Service Mesh (Advanced Networking)

Service meshes (Istio, Linkerd) provide advanced networking features: traffic management, security policies, observability.

graph LR
    A["Application Pods"] -->B["Service Mesh
Sidecar Proxies"]
    B -->C["Centralized Control
Traffic Management"]
    C -->D["Features:
Routing, Security
Metrics, Tracing"]
    
    style C fill:#e1f5ff
    style D fill:#fff3e0

Network Troubleshooting

Connectivity Tests

# From within pod, test DNS resolution
kubectl exec -it POD_NAME -- nslookup SERVICE_NAME

# Test connectivity
kubectl exec -it POD_NAME -- curl SERVICE_NAME:PORT

# View DNS logs
kubectl logs -n kube-system -l k8s-app=kube-dns

Network Policy Debugging

# View applied policies
kubectl get networkpolicies

# Describe policy
kubectl describe networkpolicy POLICY_NAME

# Test connectivity after applying policy
kubectl run test --image=busybox -it -- sh
# From inside: wget api:80

Common Pitfalls

• No NetworkPolicies - Allows unrestricted pod communication (security risk)
• Hardcoding pod IPs - Pod IPs change; use service DNS
• Overlapping pod CIDR ranges - When adding clusters; plan CIDR carefully
• DNS resolution failures - Check coredns pods, network connectivity

Key Takeaways

• Kubernetes implements flat pod network where all pods have unique IPs and communicate without NAT
• Services provide stable DNS names and load balancing, abstracting pod IP instability
• Endpoints automatically track healthy pods and update service routing
• NetworkPolicies enforce pod isolation and restrict ingress/egress traffic
• CNI plugins implement actual networking; different plugins serve different requirements
• Service meshes provide advanced networking features for production environments
• DNS resolution is critical; troubleshoot using DNS queries and connectivity tests

Next Steps: Implement NetworkPolicies for pod isolation, test DNS resolution, verify endpoint tracking behavior.