Iptables

How a Pod reaches a Pod that keeps changing — a three-node kind lab with Cilium as a plain CNI, how a Service’s virtual IP is rewritten to a real Pod IP by node rules at PREROUTING and OUTPUT, why the iptables chain says 1/4·1/3·1/2 and spreads connections rather than requests, how db becomes db.cn4.svc.cluster.local and what CoreDNS does with it, where search and ndots multiply queries, and what dual-stack actually changes in Pod, Service and EndpointSlice fields.

What the Linux kernel does to a packet between the door and the socket, measured on an Ubuntu VM — counting the five Netfilter hooks, reading one conntrack entry and its state changes, DNAT to a Service-like address with kube-proxy’s random rule, MASQUERADE out of a namespace, a node as a router, an external SYN meeting 0.0.0.0 vs 127.0.0.1, and where eBPF plugs in.

리눅스 커널 IP 경로의 정해진 다섯 지점에서, 등록된 함수를 순서대로 불러 패킷을 검사·수정·폐기하게 하는 커널 프레임워크. iptables, nftables, conntrack 이 이 위에 올라간다.