Kube-Proxy

Kubernetes networking abstractions from the inside of the cluster — why a Service object existing and traffic actually flowing are two different facts separated by controllers and a node datapath, what a StatefulSet fixes (ordinal names, PVC, DNS) and what it does not (Pod IP), why Endpoints became EndpointSlice and how to read ready·serving·terminating, port vs targetPort vs containerPort, what NodePort’s Cluster and Local policies trade, how to tell whether iptables, nftables or Cilium eBPF is carrying your Services, and why Headless and ExternalName are Services without a virtual IP.

How a Pod reaches a Pod that keeps changing — a three-node kind lab with Cilium as a plain CNI, how a Service’s virtual IP is rewritten to a real Pod IP by node rules at PREROUTING and OUTPUT, why the iptables chain says 1/4·1/3·1/2 and spreads connections rather than requests, how db becomes db.cn4.svc.cluster.local and what CoreDNS does with it, where search and ndots multiply queries, and what dual-stack actually changes in Pod, Service and EndpointSlice fields.

The Kubernetes network model read from the room up — why a Pod gets one IP and shares it across containers, the three rules every CNI must satisfy and where NAT still lives, how a Pod IP is born in two steps and dies only with the Pod, what kubelet actually does when it probes, and the /24-vs-/32 choice that decides whether the host sees every packet.