Kubernetes Networking Notes
A Pod gets its own network namespace.
Inside a namespace:
are isolated from the host.
Think:
Host Network Namespace ↓ Pod Network Namespace
A veth pair is like a virtual cable.
Example:
Pod eth0 ↔ veth123
One end is inside Pod.
One end is on host.
Traffic enters/leaves Pod through veth.
A bridge works like a virtual switch.
Example:
PodA ↓ veth ↓ Bridge ↓ veth ↓ PodB
Bridge works at Layer 2.
Routing decides:
"Where should packet go next?"
Example:
DST=172.16.212.50
Kernel checks routing table.
Chooses interface.
Sends packet.
Routing happens after DNAT.
Hooks are checkpoints inside kernel.
Packet just arrived.
Used mainly for:
Packet destined for local host.
Examples:
Packet passing through host.
Examples:
Packet generated locally.
Examples:
Packet leaving system.
Used mainly for:
Change destination.
Example:
10.96.0.25 ↓ 172.16.212.50
Used by:
Change source.
Example:
172.16.212.50 ↓ 192.168.241.141
Used when returning traffic.
Dynamic SNAT.
Commonly used when Pods access outside world.
Conntrack tracks connections.
Stores:
SRC IP SRC PORT DST IP DST PORT Protocol
Example:
192.168.1.10:50000 ↓ 10.96.0.25:80
States:
NEW ESTABLISHED RELATED INVALID
Purpose:
A Service is NOT:
Service is:
A virtual IP + kube-proxy rules.
Example:
rabbitmq-service
10.96.0.25
Flow:
Pod ↓ 10.96.0.25 ↓ kube-proxy ↓ DNAT ↓ RabbitMQ Pod
Watches:
from API Server.
Creates:
Main Job:
Service IP ↓ Pod IP
Example:
10.96.0.25 ↓ 172.16.212.50
Purpose:
Name ↓ Service IP
Example:
rabbitmq ↓ 10.96.0.25
Pod resolv.conf:
nameserver 10.96.0.10
Flow:
Application ↓ DNS Query ↓ 10.96.0.10 ↓ kube-proxy ↓ CoreDNS Pod ↓ Returns Service IP
CoreDNS watches API Server.
Keeps service records in memory.
Example:
rabbitmq → 10.96.0.25
mysql → 10.96.0.50
Purpose:
Calico uses Linux networking.
Creates:
Traffic:
PodA ↓ Host Network ↓ FORWARD ↓ Calico Rules ↓ PodB
Network Policy controls:
pod communication.
Implemented by Calico.
Calico creates iptables rules.
Example:
Allow:
frontend ↓ backend
Deny:
all others
Chain = Collection of Rules.
Example:
FORWARD chain
contains many rules.
Can call another chain.
Example:
FORWARD ↓ CALICO-FORWARD ↓ Policy Rules
Think:
Main Chain ↓ Sub Chain ↓ Rules
PodA ↓ veth ↓ Host Routing ↓ Calico ↓ Worker2 ↓ PodB
PodA ↓ Service IP 10.96.0.25 ↓ kube-proxy DNAT ↓ PodB
Application
curl rabbitmq
↓
CoreDNS
↓
10.96.0.25
↓
Application connects
↓
kube-proxy
↓
RabbitMQ Pod
Ingress Object:
Routing Rules.
Example:
myrabbitmqui.com ↓ rabbitmq-service
Ingress Object does NOT receive traffic.
Actual software.
Examples:
Receives HTTP/HTTPS traffic.
Reads:
Host Header
Example:
Host: myrabbitmqui.com
↓
rabbitmq-service
Browser ↓ 443 ↓ Ingress Controller ↓ Certificate Validation ↓ Encrypted Traffic
Certificate usually stored in:
Kubernetes Secret
Browser ↓ myrabbitmqui.com ↓ DNS ↓ Worker IP / LoadBalancer ↓ Ingress Controller ↓ rabbitmq-service ↓ kube-proxy ↓ RabbitMQ Pod
Name → Service IP
Service IP → Pod IP
Can packet travel there?
How packet reaches destination
Host Name → Service
Connection Tracking
Change Destination
Change Source
Virtual IP
Actual Application