[{"data":1,"prerenderedAt":1705},["ShallowReactive",2],{"blog-\u002Fblog\u002Fkubernetes\u002Fnetworking\u002F06-networking-notes":3},{"id":4,"title":5,"body":6,"date":1692,"description":1693,"extension":1694,"meta":1695,"navigation":1696,"path":1697,"seo":1698,"stem":1699,"tags":1700,"__hash__":1704},"blog\u002Fblog\u002Fkubernetes\u002Fnetworking\u002F06-networking-notes.md","Kubernetes Networking: Services, Ingress & Network Policies",{"type":7,"value":8,"toc":1682},"minimark",[9,13,16,39,42,45,50,69,74,84,95,98,258,325,332,335,338,349,354,357,362,365,367,468,472,475,478,481,485,499,504,507,511,514,525,544,550,553,565,571,574,658,661,689,696,702,713,716,906,909,912,1111,1145,1149,1152,1157,1174,1179,1186,1191,1194,1197,1406,1409,1443,1448,1462,1465,1470,1473,1678],[10,11,12],"p",{},"Networking is one of the trickier parts of Kubernetes to wrap your head around. Unlike a traditional server where you just open a port, in Kubernetes every pod gets its own IP address that can disappear the moment the pod is rescheduled. On top of that, you have multiple layers — node ports, cluster-internal IPs, load balancers, ingress rules — each solving a different piece of the connectivity puzzle.",[10,14,15],{},"This post walks through the core networking primitives you need to understand to confidently deploy and expose workloads in a cluster:",[17,18,19,27,33],"ul",{},[20,21,22,26],"li",{},[23,24,25],"strong",{},"Services"," (NodePort, ClusterIP, LoadBalancer) — how pods talk to each other and to the outside world",[20,28,29,32],{},[23,30,31],{},"Ingress"," — a smarter, URL-routing layer on top of services",[20,34,35,38],{},[23,36,37],{},"Network Policies"," — how to lock down traffic between pods when the default \"allow all\" isn't good enough",[10,40,41],{},"These notes are based on hands-on study for the CKAD exam but apply to any real-world cluster setup.",[43,44],"hr",{},[46,47,49],"h1",{"id":48},"service","Service",[17,51,52,55],{},[20,53,54],{},"A service allow communication between two or more pods.",[20,56,57,58],{},"Service enable external access to the kubernetes pods. Services has many types\n",[17,59,60,63,66],{},[20,61,62],{},"NodePort Service ( service listen on a particular port of a node and forward the request to the pod in kubernetes)",[20,64,65],{},"ClusterIP",[20,67,68],{},"Load Balancer",[70,71,73],"h2",{"id":72},"nodeport","NodePort",[10,75,76,77],{},"this service listens for requests on a specific port of a node and forward the request to the pod. Scope of this service is to allow access to cluster port i.e. ",[78,79,80,81],"node-ip",{},":",[82,83],"node-port",{},[85,86,87],"blockquote",{},[10,88,89,90,94],{},"A service is a like a virtual server inside the node, it has it own IP address and port. The IP is called ",[91,92,93],"code",{},"Cluster IP"," of the service",[10,96,97],{},"A service definition file looks like",[99,100,105],"pre",{"className":101,"code":102,"language":103,"meta":104,"style":104},"language-yaml shiki shiki-themes github-light github-dark","apiVersion: v1\nkind: Service\nmetadata:\n name: myapp-service\nspec:\n type: NodePort\n ports:\n  - targetPort: 80 # port of the Pod where request will land eventually\n    port: 80  # port of the service\n    nodePort: 30008 # port on the node that allow us to access the node externally\n selector:\n  app: myapp\n  type: front-end\n","yaml","",[91,106,107,124,135,144,155,163,174,182,201,214,228,236,247],{"__ignoreMap":104},[108,109,112,116,120],"span",{"class":110,"line":111},"line",1,[108,113,115],{"class":114},"s9eBZ","apiVersion",[108,117,119],{"class":118},"sVt8B",": ",[108,121,123],{"class":122},"sZZnC","v1\n",[108,125,127,130,132],{"class":110,"line":126},2,[108,128,129],{"class":114},"kind",[108,131,119],{"class":118},[108,133,134],{"class":122},"Service\n",[108,136,138,141],{"class":110,"line":137},3,[108,139,140],{"class":114},"metadata",[108,142,143],{"class":118},":\n",[108,145,147,150,152],{"class":110,"line":146},4,[108,148,149],{"class":114}," name",[108,151,119],{"class":118},[108,153,154],{"class":122},"myapp-service\n",[108,156,158,161],{"class":110,"line":157},5,[108,159,160],{"class":114},"spec",[108,162,143],{"class":118},[108,164,166,169,171],{"class":110,"line":165},6,[108,167,168],{"class":114}," type",[108,170,119],{"class":118},[108,172,173],{"class":122},"NodePort\n",[108,175,177,180],{"class":110,"line":176},7,[108,178,179],{"class":114}," ports",[108,181,143],{"class":118},[108,183,185,188,191,193,197],{"class":110,"line":184},8,[108,186,187],{"class":118},"  - ",[108,189,190],{"class":114},"targetPort",[108,192,119],{"class":118},[108,194,196],{"class":195},"sj4cs","80",[108,198,200],{"class":199},"sJ8bj"," # port of the Pod where request will land eventually\n",[108,202,204,207,209,211],{"class":110,"line":203},9,[108,205,206],{"class":114},"    port",[108,208,119],{"class":118},[108,210,196],{"class":195},[108,212,213],{"class":199},"  # port of the service\n",[108,215,217,220,222,225],{"class":110,"line":216},10,[108,218,219],{"class":114},"    nodePort",[108,221,119],{"class":118},[108,223,224],{"class":195},"30008",[108,226,227],{"class":199}," # port on the node that allow us to access the node externally\n",[108,229,231,234],{"class":110,"line":230},11,[108,232,233],{"class":114}," selector",[108,235,143],{"class":118},[108,237,239,242,244],{"class":110,"line":238},12,[108,240,241],{"class":114},"  app",[108,243,119],{"class":118},[108,245,246],{"class":122},"myapp\n",[108,248,250,253,255],{"class":110,"line":249},13,[108,251,252],{"class":114},"  type",[108,254,119],{"class":118},[108,256,257],{"class":122},"front-end\n",[17,259,260,266,273,282,288,294,300],{},[20,261,262,265],{},[91,263,264],{},"port"," field is mandatory",[20,267,268,269,272],{},"Value for ",[91,270,271],{},"nodePort"," range varies between 30000 to 32767, you can provide one or k8s will automatically assign a random available port within range",[20,274,275,276,278,279,281],{},"If you don't provide any value for the ",[91,277,190],{},", k8s will use the value of ",[91,280,264],{}," by default",[20,283,284,287],{},[91,285,286],{},"ports"," section allow us to map multiple ports since it is an array.",[20,289,290,293],{},[91,291,292],{},"selector"," will allow us to map the service to an actual Pod running inside k8s",[20,295,296,297,299],{},"If you have multiple pods within the same node that have the same labels set in the ",[91,298,292],{}," of service, k8s will create the service that will allow to access to different number of pods without any extra setup\u002Fconfiguration. The load balancing will be done using algorith random.",[20,301,302,303,305,306,308,309],{},"If you have multiple pods that reside in different nodes that have the same labels set as ",[91,304,292],{}," in service and expose the same port , and you create a ",[91,307,271],{}," service, then",[17,310,311,314,322],{},[20,312,313],{},"k8s will span the service across all nodes",[20,315,316,318,319,321],{},[91,317,190],{}," will map to the same ",[91,320,271],{}," on all the nodes in the cluster",[20,323,324],{},"You can access the relevant pod using the IP of node plus the node port as shown in diagram below",[10,326,327],{},[328,329],"img",{"alt":330,"src":331},"alt text","\u002Fblog\u002Fkubernetes\u002Fnetworking\u002Fimage.png",[70,333,65],{"id":334},"clusterip",[10,336,337],{},"You can have multiple set of pods running inside a cluster for example a set of front end , backend and cache stores. Each set need to communicate to another set",[17,339,340,343,346],{},[20,341,342],{},"Front end to backend",[20,344,345],{},"Backend to cache",[20,347,348],{},"Backend to database",[85,350,351],{},[10,352,353],{},"How can we establish the communication between different set of pods inside the cluster without relying on the IP addresses of the Pods as they can change whenever a Pod is removed or created again ?",[10,355,356],{},"We can create a set of services that will allow us to have a single interface to allow communication between a set of services",[10,358,359],{},[328,360],{"alt":330,"src":361},"\u002Fblog\u002Fkubernetes\u002Fnetworking\u002Fimage-1.png",[10,363,364],{},"How to create a cluster ip service?",[10,366,97],{},[99,368,370],{"className":101,"code":369,"language":103,"meta":104,"style":104},"apiVersion: v1\nkind: Service\nmetadata:\n name: back-end\nspec:\n type: ClusterIP\n ports:\n  - targetPort: 80 # port of the Pod where request will land eventually\n    port: 80  # port of the service\n selector:\n  app: myapp\n  type: front-end\n",[91,371,372,380,388,394,403,409,418,424,436,446,452,460],{"__ignoreMap":104},[108,373,374,376,378],{"class":110,"line":111},[108,375,115],{"class":114},[108,377,119],{"class":118},[108,379,123],{"class":122},[108,381,382,384,386],{"class":110,"line":126},[108,383,129],{"class":114},[108,385,119],{"class":118},[108,387,134],{"class":122},[108,389,390,392],{"class":110,"line":137},[108,391,140],{"class":114},[108,393,143],{"class":118},[108,395,396,398,400],{"class":110,"line":146},[108,397,149],{"class":114},[108,399,119],{"class":118},[108,401,402],{"class":122},"back-end\n",[108,404,405,407],{"class":110,"line":157},[108,406,160],{"class":114},[108,408,143],{"class":118},[108,410,411,413,415],{"class":110,"line":165},[108,412,168],{"class":114},[108,414,119],{"class":118},[108,416,417],{"class":122},"ClusterIP\n",[108,419,420,422],{"class":110,"line":176},[108,421,179],{"class":114},[108,423,143],{"class":118},[108,425,426,428,430,432,434],{"class":110,"line":184},[108,427,187],{"class":118},[108,429,190],{"class":114},[108,431,119],{"class":118},[108,433,196],{"class":195},[108,435,200],{"class":199},[108,437,438,440,442,444],{"class":110,"line":203},[108,439,206],{"class":114},[108,441,119],{"class":118},[108,443,196],{"class":195},[108,445,213],{"class":199},[108,447,448,450],{"class":110,"line":216},[108,449,233],{"class":114},[108,451,143],{"class":118},[108,453,454,456,458],{"class":110,"line":230},[108,455,241],{"class":114},[108,457,119],{"class":118},[108,459,246],{"class":122},[108,461,462,464,466],{"class":110,"line":238},[108,463,252],{"class":114},[108,465,119],{"class":118},[108,467,257],{"class":122},[70,469,471],{"id":470},"loadbalancer","LoadBalancer",[10,473,474],{},"This allow to provision a load balancer in supported cloud providers. Hence enabling to distribute the load across multiple nodes. For example load balancing to a set of front end server.",[46,476,31],{"id":477},"ingress",[10,479,480],{},"An API object that manages external access to the services in a cluster, typically HTTP. An Ingress may be configured to give Services externally-reachable URLs, load balance traffic, terminate SSL \u002F TLS, and offer name-based virtual hosting",[70,482,484],{"id":483},"scenario","Scenario",[10,486,487,488,491,492,494,495,498],{},"Let say we want to deploy a web app that will connect to database using a service. We want to access the application using ",[91,489,490],{},"www.onlinestore.com",", we can expose the app using ",[91,493,271],{}," service and access the app using ",[91,496,497],{},"www.onlinestore.com:node-port",".",[500,501,503],"h3",{"id":502},"deployment-on-local-data-center","Deployment on local data center",[10,505,506],{},"If we want to further make it simpler for user to access the website without adding the port while accessing the application, we can add a proxy server between our DNS server and the kubernetes cluster. The DNS server will forward the request to our proxy server (default port 80) and proxy server will forward it to the k8s on that specific port. This is how it is done we are deploying it on our data center",[500,508,510],{"id":509},"deployment-on-a-could-provider","Deployment on a could provider",[10,512,513],{},"When we have the same scenario as mentioned above but instead of deploying it locally, we are using a cloud provider for example GCP. When we configure the application everything will be the same except the kubernetes will request GCP to provision a load balancer that will route traffic from DNS server to the load balancer and this will then forward it to the k8s.",[10,515,516,517,520,521,524],{},"Now if we want to introduce another service let's say ",[91,518,519],{},"www.onlinestore.com\u002Fwatch"," and make the older application accessible using ",[91,522,523],{},"www.onlinestore.com\u002Fwear",", we now have 2 set of applications deployed on same k8s cluster, each has it's own node port service to access, now how we can configure in cloud.",[17,526,527,530],{},[20,528,529],{},"Every service will have a different load balancer",[20,531,532,533],{},"In order to route to different services, there will be another load balancer on top of it. (not a very efficient solution)\n",[17,534,535,538,541],{},[20,536,537],{},"This will over complicate the setup",[20,539,540],{},"Where you will setup the SSL ?",[20,542,543],{},"Every time you configure a new service you have make changes in load balancer as well",[10,545,546,547,549],{},"All of it can be done using ",[91,548,31],{}," a kubernetes object that will allow to expose multiple services, load balancing, routing and other stuff. The ingress still need to be exposed as a Node port service or a load balancer in cloud environment.",[10,551,552],{},"Without ingress we can do it using a reverse proxy or load balancing solution like nginx, HAProxy or traefik. We have to configure URL routes, configuring SSL certificates and other configuration.",[85,554,555],{},[10,556,557,558,561,562,498],{},"Ingress is implemented by Kubernetes in kind of the same way, first deploy the supported solution and provide the configuration (a set of rules). The deployed solution is called ",[91,559,560],{},"Ingress Controller",". And the set of rules are called ",[91,563,564],{},"Ingress Resources",[10,566,567],{},[568,569,570],"em",{},"By default k8s does not have an ingress controller, you have to install it manually",[10,572,573],{},"If you have a single service that need to be expose we can simply specify the service name and port like below",[99,575,577],{"className":101,"code":576,"language":103,"meta":104,"style":104},"apiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\nmetadata:\n name: ingress-wear\nspec:\n backend:\n  service:\n    name: wear-service\n    port:\n      number: 80\n",[91,578,579,588,597,603,612,618,625,632,642,648],{"__ignoreMap":104},[108,580,581,583,585],{"class":110,"line":111},[108,582,115],{"class":114},[108,584,119],{"class":118},[108,586,587],{"class":122},"networking.k8s.io\u002Fv1\n",[108,589,590,592,594],{"class":110,"line":126},[108,591,129],{"class":114},[108,593,119],{"class":118},[108,595,596],{"class":122},"Ingress\n",[108,598,599,601],{"class":110,"line":137},[108,600,140],{"class":114},[108,602,143],{"class":118},[108,604,605,607,609],{"class":110,"line":146},[108,606,149],{"class":114},[108,608,119],{"class":118},[108,610,611],{"class":122},"ingress-wear\n",[108,613,614,616],{"class":110,"line":157},[108,615,160],{"class":114},[108,617,143],{"class":118},[108,619,620,623],{"class":110,"line":165},[108,621,622],{"class":114}," backend",[108,624,143],{"class":118},[108,626,627,630],{"class":110,"line":176},[108,628,629],{"class":114},"  service",[108,631,143],{"class":118},[108,633,634,637,639],{"class":110,"line":184},[108,635,636],{"class":114},"    name",[108,638,119],{"class":118},[108,640,641],{"class":122},"wear-service\n",[108,643,644,646],{"class":110,"line":203},[108,645,206],{"class":114},[108,647,143],{"class":118},[108,649,650,653,655],{"class":110,"line":216},[108,651,652],{"class":114},"      number",[108,654,119],{"class":118},[108,656,657],{"class":195},"80\n",[10,659,660],{},"If you have multiple domain entries in your DNS, you can point them to same ingress controller in your K8s cluster. For example",[17,662,663,672,679,686],{},[20,664,665],{},[666,667,671],"a",{"href":668,"rel":669},"http:\u002F\u002Fwww.my-online-store.com",[670],"nofollow","www.my-online-store.com",[20,673,674],{},[666,675,678],{"href":676,"rel":677},"http:\u002F\u002Fwww.wear.my-online-store.com",[670],"www.wear.my-online-store.com",[20,680,681],{},[666,682,685],{"href":683,"rel":684},"http:\u002F\u002Fwww.watch.my-online-store.com",[670],"www.watch.my-online-store.com",[20,687,688],{},"Everything else",[10,690,691,692,695],{},"You can specify rules to route traffic based on different conditions. Within each rule you can specify different ",[91,693,694],{},"paths"," to route traffic to different backend services.",[10,697,698,699,701],{},"For example for ",[91,700,671],{}," we can have following paths",[17,703,704,707,710],{},[20,705,706],{},"\u002Fwear",[20,708,709],{},"\u002Fwatch",[20,711,712],{},"\u002F",[10,714,715],{},"So we have a rule for each domain name and against each rule and we can have multiple paths.",[99,717,719],{"className":101,"code":718,"language":103,"meta":104,"style":104},"apiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\nmetadata:\n name: ingress-wear\nspec:\n rules: \n  - http:\n     paths:\n     - path: \u002Fwear\n       pathType: Prefix\n       backend:\n        service:\n         name: wear-service\n         port:\n          number: 80\n     - path: \u002Fwatch\n       pathType: Prefix\n       backend:\n        service:\n         name: watch-service\n         port:\n          number: 80\n",[91,720,721,729,737,743,751,757,765,774,781,794,804,811,818,827,835,845,857,866,873,880,890,897],{"__ignoreMap":104},[108,722,723,725,727],{"class":110,"line":111},[108,724,115],{"class":114},[108,726,119],{"class":118},[108,728,587],{"class":122},[108,730,731,733,735],{"class":110,"line":126},[108,732,129],{"class":114},[108,734,119],{"class":118},[108,736,596],{"class":122},[108,738,739,741],{"class":110,"line":137},[108,740,140],{"class":114},[108,742,143],{"class":118},[108,744,745,747,749],{"class":110,"line":146},[108,746,149],{"class":114},[108,748,119],{"class":118},[108,750,611],{"class":122},[108,752,753,755],{"class":110,"line":157},[108,754,160],{"class":114},[108,756,143],{"class":118},[108,758,759,762],{"class":110,"line":165},[108,760,761],{"class":114}," rules",[108,763,764],{"class":118},": \n",[108,766,767,769,772],{"class":110,"line":176},[108,768,187],{"class":118},[108,770,771],{"class":114},"http",[108,773,143],{"class":118},[108,775,776,779],{"class":110,"line":184},[108,777,778],{"class":114},"     paths",[108,780,143],{"class":118},[108,782,783,786,789,791],{"class":110,"line":203},[108,784,785],{"class":118},"     - ",[108,787,788],{"class":114},"path",[108,790,119],{"class":118},[108,792,793],{"class":122},"\u002Fwear\n",[108,795,796,799,801],{"class":110,"line":216},[108,797,798],{"class":114},"       pathType",[108,800,119],{"class":118},[108,802,803],{"class":122},"Prefix\n",[108,805,806,809],{"class":110,"line":230},[108,807,808],{"class":114},"       backend",[108,810,143],{"class":118},[108,812,813,816],{"class":110,"line":238},[108,814,815],{"class":114},"        service",[108,817,143],{"class":118},[108,819,820,823,825],{"class":110,"line":249},[108,821,822],{"class":114},"         name",[108,824,119],{"class":118},[108,826,641],{"class":122},[108,828,830,833],{"class":110,"line":829},14,[108,831,832],{"class":114},"         port",[108,834,143],{"class":118},[108,836,838,841,843],{"class":110,"line":837},15,[108,839,840],{"class":114},"          number",[108,842,119],{"class":118},[108,844,657],{"class":195},[108,846,848,850,852,854],{"class":110,"line":847},16,[108,849,785],{"class":118},[108,851,788],{"class":114},[108,853,119],{"class":118},[108,855,856],{"class":122},"\u002Fwatch\n",[108,858,860,862,864],{"class":110,"line":859},17,[108,861,798],{"class":114},[108,863,119],{"class":118},[108,865,803],{"class":122},[108,867,869,871],{"class":110,"line":868},18,[108,870,808],{"class":114},[108,872,143],{"class":118},[108,874,876,878],{"class":110,"line":875},19,[108,877,815],{"class":114},[108,879,143],{"class":118},[108,881,883,885,887],{"class":110,"line":882},20,[108,884,822],{"class":114},[108,886,119],{"class":118},[108,888,889],{"class":122},"watch-service\n",[108,891,893,895],{"class":110,"line":892},21,[108,894,832],{"class":114},[108,896,143],{"class":118},[108,898,900,902,904],{"class":110,"line":899},22,[108,901,840],{"class":114},[108,903,119],{"class":118},[108,905,657],{"class":195},[10,907,908],{},"K8s expect a default backend service in case no path matches, it route traffic to that service",[10,910,911],{},"For multiple host names",[99,913,915],{"className":101,"code":914,"language":103,"meta":104,"style":104},"apiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\nmetadata:\n name: ingress-wear\nspec:\n rules:\n  - host: wear.my-online-store.com\n     http:\n      paths:\n      - pathType: Prefix\n        backend:\n         service:\n          name: wear-service\n          port:\n           number: 80\n  - host: watch.my-online-store.com\n     http:\n      paths:\n       - pathType: Prefix\n         backend:\n          service:\n           name: watch-service\n           port:\n            number: 80\n",[91,916,917,925,933,939,947,953,959,971,978,985,997,1004,1011,1020,1027,1036,1047,1053,1059,1070,1077,1084,1093,1101],{"__ignoreMap":104},[108,918,919,921,923],{"class":110,"line":111},[108,920,115],{"class":114},[108,922,119],{"class":118},[108,924,587],{"class":122},[108,926,927,929,931],{"class":110,"line":126},[108,928,129],{"class":114},[108,930,119],{"class":118},[108,932,596],{"class":122},[108,934,935,937],{"class":110,"line":137},[108,936,140],{"class":114},[108,938,143],{"class":118},[108,940,941,943,945],{"class":110,"line":146},[108,942,149],{"class":114},[108,944,119],{"class":118},[108,946,611],{"class":122},[108,948,949,951],{"class":110,"line":157},[108,950,160],{"class":114},[108,952,143],{"class":118},[108,954,955,957],{"class":110,"line":165},[108,956,761],{"class":114},[108,958,143],{"class":118},[108,960,961,963,966,968],{"class":110,"line":176},[108,962,187],{"class":118},[108,964,965],{"class":114},"host",[108,967,119],{"class":118},[108,969,970],{"class":122},"wear.my-online-store.com\n",[108,972,973,976],{"class":110,"line":184},[108,974,975],{"class":114},"     http",[108,977,143],{"class":118},[108,979,980,983],{"class":110,"line":203},[108,981,982],{"class":114},"      paths",[108,984,143],{"class":118},[108,986,987,990,993,995],{"class":110,"line":216},[108,988,989],{"class":118},"      - ",[108,991,992],{"class":114},"pathType",[108,994,119],{"class":118},[108,996,803],{"class":122},[108,998,999,1002],{"class":110,"line":230},[108,1000,1001],{"class":114},"        backend",[108,1003,143],{"class":118},[108,1005,1006,1009],{"class":110,"line":238},[108,1007,1008],{"class":114},"         service",[108,1010,143],{"class":118},[108,1012,1013,1016,1018],{"class":110,"line":249},[108,1014,1015],{"class":114},"          name",[108,1017,119],{"class":118},[108,1019,641],{"class":122},[108,1021,1022,1025],{"class":110,"line":829},[108,1023,1024],{"class":114},"          port",[108,1026,143],{"class":118},[108,1028,1029,1032,1034],{"class":110,"line":837},[108,1030,1031],{"class":114},"           number",[108,1033,119],{"class":118},[108,1035,657],{"class":195},[108,1037,1038,1040,1042,1044],{"class":110,"line":847},[108,1039,187],{"class":118},[108,1041,965],{"class":114},[108,1043,119],{"class":118},[108,1045,1046],{"class":122},"watch.my-online-store.com\n",[108,1048,1049,1051],{"class":110,"line":859},[108,1050,975],{"class":114},[108,1052,143],{"class":118},[108,1054,1055,1057],{"class":110,"line":868},[108,1056,982],{"class":114},[108,1058,143],{"class":118},[108,1060,1061,1064,1066,1068],{"class":110,"line":875},[108,1062,1063],{"class":118},"       - ",[108,1065,992],{"class":114},[108,1067,119],{"class":118},[108,1069,803],{"class":122},[108,1071,1072,1075],{"class":110,"line":882},[108,1073,1074],{"class":114},"         backend",[108,1076,143],{"class":118},[108,1078,1079,1082],{"class":110,"line":892},[108,1080,1081],{"class":114},"          service",[108,1083,143],{"class":118},[108,1085,1086,1089,1091],{"class":110,"line":899},[108,1087,1088],{"class":114},"           name",[108,1090,119],{"class":118},[108,1092,889],{"class":122},[108,1094,1096,1099],{"class":110,"line":1095},23,[108,1097,1098],{"class":114},"           port",[108,1100,143],{"class":118},[108,1102,1104,1107,1109],{"class":110,"line":1103},24,[108,1105,1106],{"class":114},"            number",[108,1108,119],{"class":118},[108,1110,657],{"class":195},[99,1112,1116],{"className":1113,"code":1114,"language":1115,"meta":104,"style":104},"language-bash shiki shiki-themes github-light github-dark","kubectl create ingress simple  --rule=\"\u002Fbar=barservice-name:portnumber\" --rule=\"\u002Ffoo=foo-service-name:portnumber\n","bash",[91,1117,1118],{"__ignoreMap":104},[108,1119,1120,1124,1127,1130,1133,1136,1139,1142],{"class":110,"line":111},[108,1121,1123],{"class":1122},"sScJk","kubectl",[108,1125,1126],{"class":122}," create",[108,1128,1129],{"class":122}," ingress",[108,1131,1132],{"class":122}," simple",[108,1134,1135],{"class":195},"  --rule=",[108,1137,1138],{"class":122},"\"\u002Fbar=barservice-name:portnumber\"",[108,1140,1141],{"class":195}," --rule=",[108,1143,1144],{"class":122},"\"\u002Ffoo=foo-service-name:portnumber\n",[70,1146,1148],{"id":1147},"networking-policies","Networking Policies",[10,1150,1151],{},"Lets say we have a simple 3 tier architecture, a web server , an API server and a database server.",[10,1153,1154],{},[328,1155],{"alt":330,"src":1156},"\u002Fblog\u002Fkubernetes\u002Fnetworking\u002Fimage-3.png",[17,1158,1159,1162,1165,1168,1171],{},[20,1160,1161],{},"User send request from browser to web server  at port 80 (ingress)",[20,1163,1164],{},"Web server send request to backend Server at port 5000 (egress)",[20,1166,1167],{},"App server accept request at port 5000 (ingress)",[20,1169,1170],{},"App Server send request to database server at port 3306 (egress)",[20,1172,1173],{},"Database server receive request from app server at port 3306 (ingress)",[10,1175,1176],{},[328,1177],{"alt":330,"src":1178},"\u002Fblog\u002Fkubernetes\u002Fnetworking\u002Fimage-2.png",[10,1180,1181,1182,1185],{},"By default all pods and services can communicate with each other in a node, there is no restriction, so k8s is set in ",[91,1183,1184],{},"Allow All"," mode.",[10,1187,1188],{},[328,1189],{"alt":330,"src":1190},"\u002Fblog\u002Fkubernetes\u002Fnetworking\u002Fimage-4.png",[10,1192,1193],{},"A network policy is another k8s object just like pod, services and replica sets. It allows us to isolate traffic (ingree\u002Fegress) to a pod. By default there is no isolation.",[10,1195,1196],{},"As discussed above , let us now create a policy that will only allow the traffic to database server from the backend server at port 3306",[99,1198,1200],{"className":101,"code":1199,"language":103,"meta":104,"style":104},"apiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n name: db-policy\nspec:\n podSelector:   # pod on which we apply the policy\n  matchLabels:\n   role: db\n policyTypes:   # we can have both Ingress and Egress rules here\n  - Ingress\n ingress:\n  - from:\n    - podSelector:  # pod that will be allowed to reach the above mentioned pod (role=db)\n       matchLabels:\n        name: api-pod \n      namespaceSelector:  # if we want only pods (with label name=api-pod) from a specific namespace can reach to database, we provide a namespace selector also\n       matchLabels:\n        name: prod\n    - ipBlock:\n        cidr: 192.168.5.10\u002F32\n    ports:\n     - protocol: TCP\n       port: 3306\n",[91,1201,1202,1210,1219,1225,1234,1240,1251,1258,1268,1278,1284,1290,1299,1313,1320,1333,1343,1349,1358,1367,1377,1384,1396],{"__ignoreMap":104},[108,1203,1204,1206,1208],{"class":110,"line":111},[108,1205,115],{"class":114},[108,1207,119],{"class":118},[108,1209,587],{"class":122},[108,1211,1212,1214,1216],{"class":110,"line":126},[108,1213,129],{"class":114},[108,1215,119],{"class":118},[108,1217,1218],{"class":122},"NetworkPolicy\n",[108,1220,1221,1223],{"class":110,"line":137},[108,1222,140],{"class":114},[108,1224,143],{"class":118},[108,1226,1227,1229,1231],{"class":110,"line":146},[108,1228,149],{"class":114},[108,1230,119],{"class":118},[108,1232,1233],{"class":122},"db-policy\n",[108,1235,1236,1238],{"class":110,"line":157},[108,1237,160],{"class":114},[108,1239,143],{"class":118},[108,1241,1242,1245,1248],{"class":110,"line":165},[108,1243,1244],{"class":114}," podSelector",[108,1246,1247],{"class":118},":   ",[108,1249,1250],{"class":199},"# pod on which we apply the policy\n",[108,1252,1253,1256],{"class":110,"line":176},[108,1254,1255],{"class":114},"  matchLabels",[108,1257,143],{"class":118},[108,1259,1260,1263,1265],{"class":110,"line":184},[108,1261,1262],{"class":114},"   role",[108,1264,119],{"class":118},[108,1266,1267],{"class":122},"db\n",[108,1269,1270,1273,1275],{"class":110,"line":203},[108,1271,1272],{"class":114}," policyTypes",[108,1274,1247],{"class":118},[108,1276,1277],{"class":199},"# we can have both Ingress and Egress rules here\n",[108,1279,1280,1282],{"class":110,"line":216},[108,1281,187],{"class":118},[108,1283,596],{"class":122},[108,1285,1286,1288],{"class":110,"line":230},[108,1287,1129],{"class":114},[108,1289,143],{"class":118},[108,1291,1292,1294,1297],{"class":110,"line":238},[108,1293,187],{"class":118},[108,1295,1296],{"class":114},"from",[108,1298,143],{"class":118},[108,1300,1301,1304,1307,1310],{"class":110,"line":249},[108,1302,1303],{"class":118},"    - ",[108,1305,1306],{"class":114},"podSelector",[108,1308,1309],{"class":118},":  ",[108,1311,1312],{"class":199},"# pod that will be allowed to reach the above mentioned pod (role=db)\n",[108,1314,1315,1318],{"class":110,"line":829},[108,1316,1317],{"class":114},"       matchLabels",[108,1319,143],{"class":118},[108,1321,1322,1325,1327,1330],{"class":110,"line":837},[108,1323,1324],{"class":114},"        name",[108,1326,119],{"class":118},[108,1328,1329],{"class":122},"api-pod",[108,1331,1332],{"class":118}," \n",[108,1334,1335,1338,1340],{"class":110,"line":847},[108,1336,1337],{"class":114},"      namespaceSelector",[108,1339,1309],{"class":118},[108,1341,1342],{"class":199},"# if we want only pods (with label name=api-pod) from a specific namespace can reach to database, we provide a namespace selector also\n",[108,1344,1345,1347],{"class":110,"line":859},[108,1346,1317],{"class":114},[108,1348,143],{"class":118},[108,1350,1351,1353,1355],{"class":110,"line":868},[108,1352,1324],{"class":114},[108,1354,119],{"class":118},[108,1356,1357],{"class":122},"prod\n",[108,1359,1360,1362,1365],{"class":110,"line":875},[108,1361,1303],{"class":118},[108,1363,1364],{"class":114},"ipBlock",[108,1366,143],{"class":118},[108,1368,1369,1372,1374],{"class":110,"line":882},[108,1370,1371],{"class":114},"        cidr",[108,1373,119],{"class":118},[108,1375,1376],{"class":122},"192.168.5.10\u002F32\n",[108,1378,1379,1382],{"class":110,"line":892},[108,1380,1381],{"class":114},"    ports",[108,1383,143],{"class":118},[108,1385,1386,1388,1391,1393],{"class":110,"line":899},[108,1387,785],{"class":118},[108,1389,1390],{"class":114},"protocol",[108,1392,119],{"class":118},[108,1394,1395],{"class":122},"TCP\n",[108,1397,1398,1401,1403],{"class":110,"line":1095},[108,1399,1400],{"class":114},"       port",[108,1402,119],{"class":118},[108,1404,1405],{"class":195},"3306\n",[10,1407,1408],{},"Things to note in above template",[17,1410,1411,1424,1433,1440],{},[20,1412,1413,1415,1416,1419,1420,1423],{},[91,1414,1306],{}," and ",[91,1417,1418],{},"namespaceSelector"," works as ",[91,1421,1422],{},"AND"," in above rule",[20,1425,1426,1427,1429,1430],{},"If add a  dash (-) just before the ",[91,1428,1418],{}," the first two rules will behave as ",[91,1431,1432],{},"OR",[20,1434,1435,1436,1419,1438],{},"The first rule and second rule ",[91,1437,1364],{},[91,1439,1432],{},[20,1441,1442],{},"We don't have to add the egress for 3306 because the response from database to API will be allowed automatically",[85,1444,1445],{},[10,1446,1447],{},"Kubernetes network policies are plugins based on the networking solution installed in cluster. Some of the solutions that support it are",[17,1449,1450,1453,1456,1459],{},[20,1451,1452],{},"Kube-router",[20,1454,1455],{},"Calico",[20,1457,1458],{},"Romana",[20,1460,1461],{},"Weave-net",[10,1463,1464],{},"Solutions that don't support Network policies are",[17,1466,1467],{},[20,1468,1469],{},"Flannel",[10,1471,1472],{},"Now what if we want the database server to send a request to backup server (an agent installed on db server).",[99,1474,1476],{"className":101,"code":1475,"language":103,"meta":104,"style":104},"apiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n name: db-policy\nspec:\n podSelector:\n  matchLabels:\n   name: db-pod\n policyTypes:\n  - Ingress\n  - Egress\n ingress:\n - from:\n   - podSelector:\n      matchLabels:\n       name: api-pod\n   ports:\n    protocol: TCP\n    port: 3306\n egress:\n - to:\n   - ipBlock:\n      cidr: 192.168.5.10\n   ports:\n    protocol: TCP\n    port: 3306\n",[91,1477,1478,1486,1494,1500,1508,1514,1520,1526,1536,1542,1548,1555,1561,1570,1579,1586,1596,1603,1612,1620,1627,1636,1644,1654,1660,1669],{"__ignoreMap":104},[108,1479,1480,1482,1484],{"class":110,"line":111},[108,1481,115],{"class":114},[108,1483,119],{"class":118},[108,1485,587],{"class":122},[108,1487,1488,1490,1492],{"class":110,"line":126},[108,1489,129],{"class":114},[108,1491,119],{"class":118},[108,1493,1218],{"class":122},[108,1495,1496,1498],{"class":110,"line":137},[108,1497,140],{"class":114},[108,1499,143],{"class":118},[108,1501,1502,1504,1506],{"class":110,"line":146},[108,1503,149],{"class":114},[108,1505,119],{"class":118},[108,1507,1233],{"class":122},[108,1509,1510,1512],{"class":110,"line":157},[108,1511,160],{"class":114},[108,1513,143],{"class":118},[108,1515,1516,1518],{"class":110,"line":165},[108,1517,1244],{"class":114},[108,1519,143],{"class":118},[108,1521,1522,1524],{"class":110,"line":176},[108,1523,1255],{"class":114},[108,1525,143],{"class":118},[108,1527,1528,1531,1533],{"class":110,"line":184},[108,1529,1530],{"class":114},"   name",[108,1532,119],{"class":118},[108,1534,1535],{"class":122},"db-pod\n",[108,1537,1538,1540],{"class":110,"line":203},[108,1539,1272],{"class":114},[108,1541,143],{"class":118},[108,1543,1544,1546],{"class":110,"line":216},[108,1545,187],{"class":118},[108,1547,596],{"class":122},[108,1549,1550,1552],{"class":110,"line":230},[108,1551,187],{"class":118},[108,1553,1554],{"class":122},"Egress\n",[108,1556,1557,1559],{"class":110,"line":238},[108,1558,1129],{"class":114},[108,1560,143],{"class":118},[108,1562,1563,1566,1568],{"class":110,"line":249},[108,1564,1565],{"class":118}," - ",[108,1567,1296],{"class":114},[108,1569,143],{"class":118},[108,1571,1572,1575,1577],{"class":110,"line":829},[108,1573,1574],{"class":118},"   - ",[108,1576,1306],{"class":114},[108,1578,143],{"class":118},[108,1580,1581,1584],{"class":110,"line":837},[108,1582,1583],{"class":114},"      matchLabels",[108,1585,143],{"class":118},[108,1587,1588,1591,1593],{"class":110,"line":847},[108,1589,1590],{"class":114},"       name",[108,1592,119],{"class":118},[108,1594,1595],{"class":122},"api-pod\n",[108,1597,1598,1601],{"class":110,"line":859},[108,1599,1600],{"class":114},"   ports",[108,1602,143],{"class":118},[108,1604,1605,1608,1610],{"class":110,"line":868},[108,1606,1607],{"class":114},"    protocol",[108,1609,119],{"class":118},[108,1611,1395],{"class":122},[108,1613,1614,1616,1618],{"class":110,"line":875},[108,1615,206],{"class":114},[108,1617,119],{"class":118},[108,1619,1405],{"class":195},[108,1621,1622,1625],{"class":110,"line":882},[108,1623,1624],{"class":114}," egress",[108,1626,143],{"class":118},[108,1628,1629,1631,1634],{"class":110,"line":892},[108,1630,1565],{"class":118},[108,1632,1633],{"class":114},"to",[108,1635,143],{"class":118},[108,1637,1638,1640,1642],{"class":110,"line":899},[108,1639,1574],{"class":118},[108,1641,1364],{"class":114},[108,1643,143],{"class":118},[108,1645,1646,1649,1651],{"class":110,"line":1095},[108,1647,1648],{"class":114},"      cidr",[108,1650,119],{"class":118},[108,1652,1653],{"class":195},"192.168.5.10\n",[108,1655,1656,1658],{"class":110,"line":1103},[108,1657,1600],{"class":114},[108,1659,143],{"class":118},[108,1661,1663,1665,1667],{"class":110,"line":1662},25,[108,1664,1607],{"class":114},[108,1666,119],{"class":118},[108,1668,1395],{"class":122},[108,1670,1672,1674,1676],{"class":110,"line":1671},26,[108,1673,206],{"class":114},[108,1675,119],{"class":118},[108,1677,1405],{"class":195},[1679,1680,1681],"style",{},"html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}",{"title":104,"searchDepth":126,"depth":126,"links":1683},[1684,1685,1686,1687,1691],{"id":72,"depth":126,"text":73},{"id":334,"depth":126,"text":65},{"id":470,"depth":126,"text":471},{"id":483,"depth":126,"text":484,"children":1688},[1689,1690],{"id":502,"depth":137,"text":503},{"id":509,"depth":137,"text":510},{"id":1147,"depth":126,"text":1148},"2026-06-23","A practical guide to how pods communicate inside and outside a Kubernetes cluster — covering NodePort, ClusterIP, LoadBalancer, Ingress controllers, and Network Policies.","md",{},true,"\u002Fblog\u002Fkubernetes\u002Fnetworking\u002F06-networking-notes",{"title":5,"description":1693},"blog\u002Fkubernetes\u002Fnetworking\u002F06-networking-notes",[1701,1702,1703],"kubernetes","networking","devops","gZd6GfIXXi4v2uF46WDTC1QdV0vNWCqggw6b-r22wG8",1782221323126]