instruction: Explain Services, Load Balancing, and Networking
output: You are viewing documentation for Kubernetes version: v1.29
  Kubernetes v1.29 documentation is no longer actively maintained. The version you are currently viewing is a static snapshot. For up-to-date information, see the
  latest version.
  Services, Load Balancing, and Networking
  Concepts and resources behind networking in Kubernetes.
  The Kubernetes network model
  Every
  in a cluster gets its own unique cluster-wide IP address.
  This means you do not need to explicitly create links between
  Pods
  and you
  almost never need to deal with mapping container ports to host ports.
  This creates a clean, backwards-compatible model where
  Pods
  can be treated
  much like VMs or physical hosts from the perspectives of port allocation,
  naming, service discovery,
  load balancing
  application configuration, and migration.
  Kubernetes imposes the following fundamental requirements on any networking
  implementation (barring any intentional network segmentation policies):
  pods can communicate with all other pods on any other
  node
  without NAT
  agents on a node (e.g. system daemons, kubelet) can communicate with all
  pods on that node
  Note: For those platforms that support
  Pods
  running in the host network (e.g.
  Linux), when pods are attached to the host network of a node they can still communicate
  with all pods on all nodes without NAT.
  This model is not only less complex overall, but it is principally compatible
  with the desire for Kubernetes to enable low-friction porting of apps from VMs
  to containers. If your job previously ran in a VM, your VM had an IP and could
  talk to other VMs in your project. This is the same basic model.
  Kubernetes IP addresses exist at the
  scope - containers within a
  share their network namespaces - including their IP address and MAC address.
  This means that containers within a
  can all reach each other's ports on
  localhost
  . This also means that containers within a
  must coordinate port
  usage, but this is no different from processes in a VM. This is called the
  "IP-per-pod" model.
  How this is implemented is a detail of the particular container runtime in use.
  It is possible to request ports on the
  Node
  itself which forward to your
  (called host ports), but this is a very niche operation. How that forwarding is
  implemented is also a detail of the container runtime. The
  itself is
  blind to the existence or non-existence of host ports.
  Kubernetes networking addresses four concerns:
  Containers within a Pod
  use networking to communicate
  via loopback.
  Cluster networking provides communication between different Pods.
  Service
  API lets you
  expose an application running in Pods
  to be reachable from outside your cluster.
  Ingress
  provides extra functionality
  specifically for exposing HTTP applications, websites and APIs.
  Gateway API
  is an
  add-on
  that provides an expressive, extensible, and role-oriented family of API kinds for modeling service networking.
  You can also use Services to
  publish services only for consumption inside your cluster
  Connecting Applications with Services
  tutorial lets you learn about Services and Kubernetes networking with a hands-on example.
  Cluster Networking
  explains how to set
  up networking for your cluster, and also provides an overview of the technologies involved.
  Service
  Expose an application running in your cluster behind a single outward-facing endpoint, even when the workload is split across multiple backends.
  Ingress
  Make your HTTP (or HTTPS) network service available using a protocol-aware configuration mechanism, that understands web concepts like URIs, hostnames, paths, and more. The Ingress concept lets you map traffic to different backends based on rules you define via the Kubernetes API.
  Ingress Controllers
  In order for an
  Ingress
  to work in your cluster, there must be an
  ingress controller
  running. You need to select at least one ingress controller and make sure it is set up in your cluster. This page lists common ingress controllers that you can deploy.
  Gateway API
  Gateway API is a family of API kinds that provide dynamic infrastructure provisioning and advanced traffic routing.
  EndpointSlices
  The EndpointSlice API is the mechanism that Kubernetes uses to let your Service scale to handle large numbers of backends, and allows the cluster to update its list of healthy backends efficiently.
  Network Policies
  If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), NetworkPolicies allow you to specify rules for traffic flow within your cluster, and also between Pods and the outside world. Your cluster must use a network plugin that supports NetworkPolicy enforcement.
  DNS for Services and Pods
  Your workload can discover Services within your cluster using DNS; this page explains how that works.
  IPv4/IPv6 dual-stack
  Kubernetes lets you configure single-stack IPv4 networking, single-stack IPv6 networking, or dual stack networking with both network families active. This page explains how.
  Topology Aware Routing
  Topology Aware Routing
  provides a mechanism to help keep network traffic within the zone where it originated. Preferring same-zone traffic between Pods in your cluster can help with reliability, performance (network latency and throughput), or cost.
  Networking on Windows
  Service ClusterIP allocation
  Service Internal Traffic Policy
  If two Pods in your cluster want to communicate, and both Pods are actually running on the same node, use
  Service Internal Traffic Policy
  to keep network traffic within that node. Avoiding a round trip via the cluster network can help with reliability, performance (network latency and throughput), or cost.
  Was this page helpful?
  Thanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on
  Stack Overflow
  Open an issue in the
  GitHub Repository
  if you want to
  report a problem
  suggest an improvement
  Last modified October 19, 2023 at 9:45 AM PST:
  Adds Gateway API docs (a74574fa8b)