Mastering Kubernetes Networking Essential

Mastering Kubernetes networking is essential for routing traffic efficiently and securing containerized microservices. This guide breaks down the core communication layers and provides clean, standard YAML manifests you can use to configure and secure your cluster traffic today. The 4 Core Networking Pillars Before deploying configurations, it helps to understand how Kubernetes approaches networking: Container-to-Container: Handled inside the same Pod via localhost because they share a network namespace. Pod-to-Pod: The fundamental network model requiring every Pod to have a unique, routable IP address across all nodes. Pod-to-Service: Employs stable virtual IPs (ClusterIPs) to balance traffic and overcome the temporary, short-lived nature of Pods. External-to-Service: Uses Ingress controllers or LoadBalancers to route incoming traffic from outside the cluster to specific internal services.1. Pod-to-Pod & Pod-to-Service Networking To enable Pod-to-Pod communication, Kubernetes relies on a Container Network Interface (CNI) layer. To expose an application to other applications within the cluster, you create a Service. Below is a standard YAML deployment file for a web application combined with a Service manifest to route traffic to the Pods:




apiVersion: v1

kind: Service

metadata:

name: webapp-service

namespace: default

spec:

selector:

app: webapp

ports:

- protocol: TCP

port: 80

targetPort: 8080

---

apiVersion: apps/v1

kind: Deployment

metadata:

name: webapp-deployment

namespace: default

spec:

replicas: 2

selector:

matchLabels:

app: webapp

template:

metadata:

labels:

app: webapp

spec:

containers:

- name: webapp-container

image: nginx:latest

ports:

- containerPort: 8080

Use code with caution.2. Securing the Network with Network PoliciesIn default Kubernetes clusters, all Pods can freely communicate with all other Pods. To enforce a Zero-Trust model, you must explicitly define Network Policies.The following YAML restricts ingress traffic to the webapp Pods, ensuring they only accept connections from Pods labeled frontend:




apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: allow-frontend-to-webapp

namespace: default

spec:

podSelector:

matchLabels:

app: webapp

policyTypes:

- Ingress

ingress:

- from:

- podSelector:

matchLabels:

app: frontend

ports:

- protocol: TCP

port: 8080




Use code with caution.3. Exposing Traffic Externally (Ingress)For external traffic, relying on multiple NodePorts is inefficient. Instead, an Ingress Controller acts as a reverse proxy, directing external traffic to your services based on the requested hostname or URL path.




apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: example-ingress

namespace: default

spec:

rules:

- host: ://example.com

http:

paths:

- path: /

pathType: Prefix

backend:

service:

name: webapp-service

port:

number: 80