Kubernetes Networking Deep Dive

Kubernetes networking can seem complex, but understanding the fundamentals is crucial for building and managing distributed applications. Let’s dive into how pods communicate with each other and the outside world.

The Kubernetes Networking Model

Kubernetes enforces a simple but powerful networking model:

1. Pods can communicate with all other pods on any node without NAT
2. Nodes can communicate with all pods on any node without NAT
3. Pods think they are on the same network as the host

CNI (Container Network Interface)

Kubernetes uses CNI plugins to implement networking. Popular CNI options include:

• Calico: BGP-based networking with network policies
• Flannel: Simple overlay networks using VXLAN
• Weave Net: Multi-host networking with automatic discovery
• Cilium: eBPF-based networking with advanced security

Service Types

Kubernetes provides different service types for exposing applications:

ClusterIP

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
  type: ClusterIP

NodePort

spec:
  type: NodePort
  ports:
    - port: 80
      targetPort: 8080
      nodePort: 30007

LoadBalancer

spec:
  type: LoadBalancer
  ports:
    - port: 80
      targetPort: 8080

Network Policies

Control pod-to-pod communication using Network Policies:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
spec:
  podSelector:
    matchLabels:
      tier: frontend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              tier: backend
      ports:
        - protocol: TCP
          port: 80

Ingress Controllers

For HTTP/HTTPS traffic routing, use Ingress controllers:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  rules:
    - host: example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 80
          - path: /web
            pathType: Prefix
            backend:
              service:
                name: web-service
                port:
                  number: 80

DNS in Kubernetes

Kubernetes provides built-in DNS service for service discovery:

• Services get DNS records: <service-name>.<namespace>.svc.cluster.local
• Pods get DNS records: <pod-ip>.<namespace>.pod.cluster.local

Troubleshooting Network Issues

Common Tools

# Check pod connectivity
kubectl exec -it <pod> -- ping <target-pod>

# Check service endpoints
kubectl get endpoints <service-name>

# Check network policies
kubectl get networkpolicies --all-namespaces

# Use netshoot for advanced debugging
kubectl run netshoot --image nicolaka/netshoot -it --rm -- /bin/bash

Debugging with eBPF

# Install bpftool
sudo apt-get install linux-tools-$(uname -r)

# Trace network connections
sudo bpftool prog load my_program.o /sys/fs/bpf/my_program
sudo bpftool net attach pinned /sys/fs/bpf/my_program type xdp dev eth0

Best Practices

1. Use Network Policies to enforce security boundaries
2. Monitor network traffic using tools like Prometheus and Grafana
3. Implement proper service discovery patterns
4. Use readiness and liveness probes for health checking
5. Consider service mesh for complex microservices architectures

Conclusion

Understanding Kubernetes networking is essential for building robust distributed systems. Start with the basics and gradually explore advanced topics like service mesh and eBPF-based networking.

In the next post, we’ll explore how to implement custom CNI plugins for specialized networking requirements.