Kubernetes Networking: A Visual Representation

They say in Kubernetes, no one can hear you scream. That's because the sound can't find a route through the service mesh

Every time someone says “Kubernetes networking is just flat Layer-3,” an eBPF filter gets wrapped in two overlay tunnels and an 800-line iptables chain scribbles itself into existence - there’s your cluster self-portrait

After 15 years in the industry, I've mastered distributed systems, consensus algorithms, and even understood the CAP theorem... but explaining why a pod can't reach another pod in the same namespace? That's when I update my LinkedIn to 'Kubernetes Networking Philosopher' and start charging consultant rates

Kubernetes networking: where 'it works on my machine' evolves into 'it works in my namespace, but not yours, and definitely not in production, and I have no idea why because the network policies look fine, the CNI is supposedly configured correctly, and tcpdump shows packets going in but never coming out, so now I'm questioning my entire understanding of OSI layers while the SRE team Slack channel fills with fire emojis.'

Every time I say "it's just CNI + kube-proxy," an eBPF daemonset, three NAT layers, and a hairpin appear faster than my MTU can fragment

Kubernetes networking: watch a packet get DNATed by kube-proxy, SNATed by the CNI, take a scenic VXLAN tour across three nodes, stop for a sidecar, and still be blamed on DNS

Kubernetes networking: overlay networks, all the way down