Mastering Kubernetes networking is essential for routing traffic efficiently and securing containerized microservices. This guide breaks down the core communication layers and provides clean, standard YAML manifests you can use to configure and secure your cluster traffic today.
The 4 Core Networking PillarsBefore deploying configurations, it helps to understand how Kubernetes approaches networking:
Container-to-Container: Handled inside the same Pod via localhost because they share a network namespace.
Pod-to-Pod: The fundamental network model requiring every Pod to have a unique, routable IP address across all nodes.
Pod-to-Service: Employs stable virtual IPs (ClusterIPs) to balance traffic and overcome the temporary, short-lived nature of Pods.
External-to-Service: Uses Ingress controllers or LoadBalancers to route incoming traffic from outside the cluster to specific internal services.
1. Pod-to-Pod & Pod-to-Service NetworkingTo enable Pod-to-Pod communication, Kubernetes relies on a Container Network Interface (CNI) layer. To expose an application to other applications within the cluster, you create a Service.
Below is a standard YAML deployment file for a web application combined with a Service manifest to route traffic to the Pods:
[code]
apiVersion: v1
kind: Service
metadata:
name: webapp-service
namespace: default
spec:
selector:
app: webapp
ports:
- protocol: TCP
port: 80
targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: webapp-deployment
namespace: default
spec:
replicas: 2
selector:
matchLabels:
app: webapp
template:
metadata:
labels:
app: webapp
spec:
containers:
- name: webapp-container
image: nginx:latest
ports:
- containerPort: 8080
[/code]
2. Securing the Network with Network PoliciesIn default Kubernetes clusters, all Pods can freely communicate with all other Pods. To enforce a Zero-Trust model, you must explicitly define Network Policies.The following YAML restricts ingress traffic to the webapp Pods, ensuring they only accept connections from Pods labeled frontend:
[code]
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend-to-webapp
namespace: default
spec:
podSelector:
matchLabels:
app: webapp
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080
[/code]
3. Exposing Traffic Externally (Ingress)For external traffic, relying on multiple NodePorts is inefficient. Instead, an Ingress Controller acts as a reverse proxy, directing external traffic to your services based on the requested hostname or URL path.
[code]
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: example-ingress
namespace: default
spec:
rules:
- host: ://example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: webapp-service
port:
number: 80
[/code]
Discussions