Kubernetes Networking

Kubernetes Services provide stable networking for pods, which are ephemeral and receive dynamic IP addresses. A Service selects pods by labels and routes traffic to them.

ClusterIP (default) exposes the Service on an internal IP only accessible within the cluster. Use this for internal microservice communication:

apiVersion: v1
kind: Service
metadata:
  name: api-service
spec:
  selector:
    app: api-server
  ports:
  - port: 80
    targetPort: 8080

NodePort exposes the Service on a static port (30000-32767) on every node. External clients connect via <NodeIP>:<NodePort>. Useful for development or when you don't have a load balancer.

LoadBalancer provisions a cloud load balancer (ALB, NLB) that routes external traffic to the Service. This is the standard way to expose services to the internet on cloud providers:

apiVersion: v1
kind: Service
metadata:
  name: api-external
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
spec:
  type: LoadBalancer
  selector:
    app: api-server
  ports:
  - port: 443
    targetPort: 8080

ExternalName maps a Service to a DNS CNAME record, allowing pods to reference external services by a stable internal name. For example, mapping an external database to db.internal so application code doesn't change if the database moves.

Ingress provides HTTP/HTTPS routing to Services based on hostnames and URL paths. An Ingress Controller (like NGINX, ALB Ingress, or Traefik) implements the routing logic.

An Ingress resource defines routing rules:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - api.example.com
    secretName: api-tls-secret
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /v1
        pathType: Prefix
        backend:
          service:
            name: api-v1
            port:
              number: 80
      - path: /v2
        pathType: Prefix
        backend:
          service:
            name: api-v2
            port:
              number: 80

TLS termination happens at the Ingress Controller. The TLS secret contains the certificate and key. Use cert-manager to automate Let's Encrypt certificate provisioning and renewal.

The AWS ALB Ingress Controller creates an Application Load Balancer for each Ingress resource. It supports path-based routing, host-based routing, authentication via Cognito, and WAF integration. For TCP/UDP workloads, use a Network Load Balancer with a MetalLB or NLB controller.

NetworkPolicies are the Kubernetes firewall. By default, all pods can communicate with all other pods. NetworkPolicies restrict this, enabling zero-trust networking within the cluster.

A basic NetworkPolicy that allows traffic only to pods with label role: api:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow
  namespace: production
spec:
  podSelector:
    matchLabels:
      role: api
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 8080

This policy only allows pods labeled role: frontend to reach pods labeled role: api on port 8080. All other ingress traffic is blocked.

Restrict egress to prevent compromised pods from exfiltrating data:

spec:
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: database
    ports:
    - protocol: TCP
      port: 5432
  - to: []
    ports:
    - protocol: UDP
      port: 53

Always allow DNS egress (port 53) or your pods will fail to resolve service names. NetworkPolicies require a CNI plugin that supports them—Calico, Cilium, and Weave all provide this.

Container Network Interface (CNI) plugins provide pod networking. Each pod gets a unique IP address, and all pods can communicate directly without NAT.

Popular CNI plugins include:

• Calico: Network policy enforcement with BGP routing, supports NetworkPolicy
• Cilium: eBPF-based networking with advanced observability and security
• Flannel: Simple overlay network, good for small clusters
• AWS VPC CNI: Assigns VPC IP addresses directly to pods, enabling security group integration

The AWS VPC CNI is unique because pods get real VPC IPs instead of overlay IPs. This means security groups, NACLs, and VPC flow logs work at the pod level. The trade-off is IP address exhaustion in large clusters—use VPC CNI with prefix delegation to allocate /28 prefixes instead of individual IPs.

Kubernetes DNS (CoreDNS) provides automatic service discovery. Every Service gets a DNS entry:

# Fully qualified
api-service.production.svc.cluster.local

# Within same namespace
api-service

# Cross-namespace
database.database-namespace

CoreDNS resolves these names and supports custom DNS policies for forwarding to external DNS servers or stub domains. Pod DNS configuration can be customized to use specific nameservers or search domains.