Kubernetes Networking

Mastering Kubernetes networking is essential for routing traffic efficiently and securing containerized microservices. This guide breaks down the core communication layers and provides clean, standard YAML manifests you can use to configure and secure your cluster traffic today. The 4 Core Networking Pillars Before deploying configurations, it helps to understand how Kubernetes approaches networking: Container-to-Container: Handled inside the same Pod via localhost because they share a network namespace. Pod-to-Pod: The fundamental network model requiring every Pod to have a unique, routable IP address across all nodes. Pod-to-Service: Employs stable virtual IPs (ClusterIPs) to balance traffic and overcome the temporary, short-lived nature of Pods. External-to-Service: Uses Ingress controllers or LoadBalancers to route incoming traffic from outside the cluster to specific internal services. 1. Pod-to-Pod & Pod-to-Service Networking To enable Pod-to-Pod communication, Kubernetes relies on a Container Network Interface (CNI) layer. To expose an application to other applications within the cluster, you create a Service. Below is a standard YAML deployment file for a web application combined with a Service manifest to route traffic to the Pods:

apiVersion: v1
kind: Service
metadata:
  name: webapp-service
  namespace: default
spec:
  selector:
    app: webapp
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: webapp-deployment
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      labels:
        app: webapp
    spec:
      containers:
      - name: webapp-container
        image: nginx:latest
        ports:
        - containerPort: 8080

 

2. Securing the Network with Network Policies In default Kubernetes clusters, all Pods can freely communicate with all other Pods. To enforce a Zero-Trust model, you must explicitly define Network Policies. The following YAML restricts ingress traffic to the webapp Pods, ensuring they only accept connections from Pods labeled frontend:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-webapp
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: webapp
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
 

3. Exposing Traffic Externally (Ingress) For external traffic, relying on multiple NodePorts is inefficient. Instead, an Ingress Controller acts as a reverse proxy, directing external traffic to your services based on the requested hostname or URL path.

[code]
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: example-ingress  namespace: default
spec:
rules:
- host: ://example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: webapp-service
port:
number: 80

[/code]