Kubernetes Networking Basics
Kubernetes networking rests on one radical rule: every pod gets its own IP, and every pod can reach every other pod directly — a flat network with no NAT inside the cluster. Everything else (Services, Ingress, CNI) exists to make that flat network usable and reachable.
The flat pod network
Unlike standalone Docker (private IPs behind NAT), Kubernetes demands pod-to-pod reachability across all nodes. CNI plugins (Calico, Cilium, Flannel) implement it — typically with an overlay or routed fabric between nodes. For a network engineer: it is one big routed subnet where endpoints (pods) appear and die constantly.
Services — stable addresses for unstable pods
| Service type | What it gives you |
|---|---|
| ClusterIP | A stable virtual IP reachable inside the cluster — the default |
| NodePort | Opens a port (30000–32767) on every node, forwarding to the service |
| LoadBalancer | Provisions a cloud load balancer pointing at the service |
Pods are ephemeral; their IPs change on every restart. A Service is the stable front — a VIP plus load-balancing across the current pods, with CoreDNS giving it a name (db.default.svc). Conceptually: a load balancer with service discovery built in.
Ingress — L7 routing at the front door
An Ingress is the HTTP(S) entry point: one external IP, routing by hostname/path to different services, with TLS termination — the reverse-proxy layer (what that means) of the cluster, usually nginx or a cloud controller underneath.
Why this matters to network engineers
Clusters do not remove the network — they multiply it: CNI choices are routing designs, NetworkPolicies are ACLs for pods, and when a service is unreachable the debugging is pure networking (DNS → VIP → endpoints → node routes). Engineers who speak both Kubernetes and networking are rare and valuable.
Frequently asked questions
How do pods communicate in Kubernetes?
Every pod gets its own IP on a flat cluster network where any pod can reach any other directly, with no NAT. CNI plugins like Calico or Cilium implement this connectivity across nodes.
What is the difference between ClusterIP, NodePort and LoadBalancer?
ClusterIP is an internal-only stable virtual IP. NodePort additionally exposes the service on a high port on every node. LoadBalancer provisions an external cloud load balancer in front of it.
What is an Ingress?
The cluster's HTTP(S) front door — a Layer 7 router that maps hostnames and paths to services, typically with TLS termination, implemented by a controller such as nginx.
What is a CNI plugin?
Container Network Interface plugins (Calico, Cilium, Flannel) implement the pod network — assigning pod IPs and providing the routing or overlay that connects pods across nodes.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.