Networking Overview¶

Kubernetes networking rests on a few simple rules, and OpenShift builds on them:

• Every pod gets its own IP address. All pods can reach each other directly, across nodes, without NAT. The cluster's network plugin (OVN-Kubernetes on OpenShift) implements this.
• Pod IPs are temporary. Pods are replaced during rollouts, scaling and failures, and each new pod gets a new IP. So clients shouldn't talk to pod IPs directly.
• Services give pods a stable address. A Service selects pods by label and provides a fixed virtual IP and DNS name, load-balancing across whichever pods are ready.
• Traffic from outside the cluster comes in through a Route or Ingress (HTTP/HTTPS), a Gateway, or a LoadBalancer/NodePort Service (any TCP/UDP).
• NetworkPolicies restrict which pods may talk to which.

flowchart TB
    user([Client outside the cluster]) -->|"https://app.apps.example.com"| router[Router / Ingress controller]
    other([Another pod in the cluster]) -->|"my-service.my-project.svc"| svc
    router -->|Route or Ingress| svc[Service: my-service]
    svc -->|"selector app=web"| p1[Pod 10.128.2.14]
    svc -->|"selector app=web"| p2[Pod 10.131.0.9]

Service discovery with DNS¶

Every Service gets a DNS name, <service>.<namespace>.svc.cluster.local. Pods in the same namespace can simply use <service>, and pods in other namespaces use <service>.<namespace>. Each port of the Service is reachable at that name:

curl http://my-service:80                  # same namespace
curl http://my-service.other-project:80    # another namespace

Ways to expose an application¶

Controlling traffic between pods¶

By default every pod accepts traffic from every other pod. Use Network Policies to allow only the traffic an application needs, for example "only the frontend may call the API on port 8080".

Resources¶

Activities¶