Kubernetes Networking and Ingress

# Kubernetes Networking and Ingress

Introduction

Kubernetes networking enables communication between pods, services, and external clients. This tutorial covers the Kubernetes networking model, CNI plugins, Service types, Ingress controllers, NetworkPolicies, and DNS resolution.

Learning Objectives

By the end of this tutorial, you will be able to:

• Explain the Kubernetes networking model
• Configure CNI networking plugins
• Use Service types (ClusterIP, NodePort, LoadBalancer)
• Implement Ingress for external HTTP access
• Configure NetworkPolicies for traffic isolation
• Understand Kubernetes DNS
• Implement service mesh concepts

Technical Background

Kubernetes Networking Model

flowchart TD
    External[External Client] -->|Ingress| LB[LoadBalancer]
    LB --> Ingress[Ingress Controller]
    Ingress --> Service[Service]
    Service -->|Kube-Proxy| Pod[Pod]
    Pod -->|CNI| CNI[CNI Network]
    Pod --> Pod2[Other Pod]
    
    subgraph Cluster Network
    Service
    Pod
    Pod2
    CNI
    end

Networking Principles

| Principle | Description | |-----------|-------------| | Pod-to-Pod | All pods can communicate without NAT | | Node-to-Pod | All nodes can communicate with all pods | | Pod-IP | Pod IP is same for all communication | | No NAT | No address translation within cluster |

Prerequisites

• Running Kubernetes cluster
• kubectl configured
• Understanding of networking concepts (IP, DNS, TCP/UDP)

Hardware and Software Requirements

| Component | Requirement | |-----------|-------------| | Kubernetes Cluster | v1.25+ | | CNI Plugin | Calico, Flannel, Cilium, or similar | | Ingress Controller | NGINX, Traefik, or similar |

Step-by-Step Implementation

Phase 1: CNI Networking

#### Install Calico

kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/calico.yaml

#### Verify CNI

kubectl get pods -n kube-system -l k8s-app=calico-node
kubectl get nodes -o wide  # Check pod CIDR ranges

Phase 2: Services

#### ClusterIP (Default)

apiVersion: v1
kind: Service
metadata:
  name: api-service
spec:
  selector:
    app: api
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP

#### NodePort

apiVersion: v1
kind: Service
metadata:
  name: api-nodeport
spec:
  selector:
    app: api
  ports:
  - port: 80
    targetPort: 8080
    nodePort: 30080
  type: NodePort

#### LoadBalancer

apiVersion: v1
kind: Service
metadata:
  name: api-lb
spec:
  selector:
    app: api
  ports:
  - port: 80
    targetPort: 8080
  type: LoadBalancer

Phase 3: Ingress

#### Deploy NGINX Ingress Controller

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx --create-namespace

#### Create Ingress Resource

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls-secret
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080

Phase 4: NetworkPolicies

#### Default Deny All

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

#### Allow Specific Namespace

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: frontend
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

Phase 5: Kubernetes DNS

#### CoreDNS

Kubernetes uses CoreDNS for service discovery. Services are accessible via:

<service-name>.<namespace>.svc.cluster.local

# Test DNS from a pod
kubectl run dns-test --image=busybox --rm -it --restart=Never -- nslookup kubernetes.default

Expected Output

• CNI networking operational
• Services accessible internally and externally
• Ingress routing HTTP traffic
• NetworkPolicies isolating traffic
• DNS resolving service names

Verification Procedures

| Check | Command | Expected Result | |-------|---------|-----------------| | CNI pods | `kubectl get pods -n kube-system -l k8s-app=calico-node` | Calico nodes Running | | Service DNS | `kubectl exec <pod> -- nslookup <service>` | DNS resolves | | Ingress | `kubectl get ingress` | ADDRESS populated | | NetworkPolicy | `kubectl get networkpolicy` | Policies listed |

Troubleshooting Scenarios

| Issue | Diagnosis | Resolution | |-------|-----------|------------| | Pods can't communicate | CNI misconfigured | Check CNI plugin; verify pod CIDR | | Service not reachable | Selector mismatch | Verify service selector matches pod labels | | Ingress 404 | Wrong path or backend | Check ingress rules; verify service exists | | DNS not working | CoreDNS issues | Check CoreDNS pods; verify RBAC | | NetworkPolicy blocking | Policy too restrictive | Adjust policy rules |

Best Practices

• **Use ClusterIP for internal services:** Don't expose internally
• **Use Ingress for HTTP:** Single entry point for external traffic
• **Implement NetworkPolicies:** Zero-trust networking
• **Use DNS for service discovery:** Don't hardcode IPs
• **TLS termination at Ingress:** Centralize certificate management
• **Limit NodePort:** Use for development only

Security Considerations

• **NetworkPolicies:** Default deny, allow explicitly
• **Ingress TLS:** Use certificates for all external traffic
• **Service mesh:** Consider mTLS for service-to-service
• **API server:** Restrict access to control plane
• **Container runtime:** Use secure container runtime

Conclusion

Kubernetes networking provides flexible communication patterns for containerized workloads. By understanding CNI, Services, Ingress, NetworkPolicies, and DNS, you can design secure, scalable network architectures for your Kubernetes clusters.

References

• Kubernetes Networking: https://kubernetes.io/docs/concepts/services-networking/
• CNI Plugins: https://www.cncf.io/cni/
• Ingress NGINX: https://kubernetes.github.io/ingress-nginx/
• NetworkPolicies: https://kubernetes.io/docs/concepts/services-networking/network-policies/
• CoreDNS: https://coredns.io/