Kubernetes Networking Model

The Three Rules

Kubernetes defines a flat networking contract and leaves implementation to plugins:

1. Every pod gets its own IP address; no NAT between pods.
2. Any pod can reach any other pod on the same node without a proxy hop.
3. Agents on a node can see all pods on that node without NAT.

The consequence is a cluster-wide flat IP space: pod A talks to pod B by IP regardless of node, and hostNetwork pods opt out by sharing the node's network namespace. Services then layer stable virtual IPs on top of pod IPs that come and go — the model separates identity (Service) from location (pod endpoints).

How the CNI Realizes It

When kubelet starts a pod, it invokes the CNI plugin configured in /etc/cni/net.d. The plugin:

1. Creates a veth pair — one end in the pod namespace, one on the host.
2. Assigns the pod IP from a node-local allocator (often a /24 carved from a larger pod CIDR).
3. Adds routes so the host can reach the pod, and programs cross-node traffic via VXLAN, BGP, or a cloud route table.

ip route show table all | grep -i tunl   # example: per-node pod routes
kubectl get pod web-abc -o jsonpath='{.status.podIP}'

kube-proxy then watches Services and programs iptables/IPVS rules that redirect the virtual Service IP to those pod IPs.

Pitfalls and Interview Angles

Pitfall 1 — overlapping pod CIDRs. If two nodes allocate the same pod IP, traffic blackholes intermittently. Allocate disjoint per-node blocks (the controller-manager --cluster-cidr with --allocate-node-cidrs=true does this for routed modes) or trust your CNI's IPAM.

Pitfall 2 — assuming ping proves the path. ICMP may be blocked while TCP works, or vice versa through policy. Test with the real port: kubectl run tmp --image=busybox --rm -it -- wget -qO- http://svc:8080/healthz.

Interview-ready: recite the three rules from memory, explain pod IP allocation and cross-node encapsulation for your CNI of choice, and separate pod-network problems (CNI, routes) from Service problems (endpoints, kube-proxy rules).