Linux

Kubernetes networking abstractions from the inside of the cluster — why a Service object existing and traffic actually flowing are two different facts separated by controllers and a node datapath, what a StatefulSet fixes (ordinal names, PVC, DNS) and what it does not (Pod IP), why Endpoints became EndpointSlice and how to read ready·serving·terminating, port vs targetPort vs containerPort, what NodePort’s Cluster and Local policies trade, how to tell whether iptables, nftables or Cilium eBPF is carrying your Services, and why Headless and ExternalName are Services without a virtual IP.

Having a path is not the same as being allowed to use it — a three-Pod lab (diagnostic, Go web server, PostgreSQL) shows what a NetworkPolicy really is: a per-Pod, per-direction allow list where both the sender’s egress door and the receiver’s ingress door must open, allow rules only add up, an empty selector, an empty list and an empty rule mean three different things, a hyphen in YAML decides AND versus OR, and the standard API stops at the TCP port while Cilium’s Envoy can refuse a single HTTP path with a 403.

How a Pod reaches a Pod that keeps changing — a three-node kind lab with Cilium as a plain CNI, how a Service’s virtual IP is rewritten to a real Pod IP by node rules at PREROUTING and OUTPUT, why the iptables chain says 1/4·1/3·1/2 and spreads connections rather than requests, how db becomes db.cn4.svc.cluster.local and what CoreDNS does with it, where search and ndots multiply queries, and what dual-stack actually changes in Pod, Service and EndpointSlice fields.

The Kubernetes network model read from the room up — why a Pod gets one IP and shares it across containers, the three rules every CNI must satisfy and where NAT still lives, how a Pod IP is born in two steps and dies only with the Pod, what kubelet actually does when it probes, and the /24-vs-/32 choice that decides whether the host sees every packet.

How a container’s room gets out — Docker’s network modes compared with real namespace numbers, inside/outside pairing by @ifN, docker0 joined to the NIC by routing and NAT, CNM vs CNI and one CNI plugin call, VXLAN overlay, and one Go server knocked on from four places: another container, the host, another machine, and a container sharing its room.

What a container actually is on an Ubuntu VM — three problems that VMs and containers each solve, the runtime stack from dockerd and kubelet down to runC, why runC vanishes and containerd-shim stays as the parent, the six namespaces and one cgroup directory seen through /proc.

What the Linux kernel does to a packet between the door and the socket, measured on an Ubuntu VM — counting the five Netfilter hooks, reading one conntrack entry and its state changes, DNAT to a Service-like address with kube-proxy’s random rule, MASQUERADE out of a namespace, a node as a router, an external SYN meeting 0.0.0.0 vs 127.0.0.1, and where eBPF plugs in.

Inside the Linux kernel on an Ubuntu VM — a Python server under strace, the same socket seen from ss and /proc, why FD 4 comes back four times, interfaces as doors and lo as a mirror, veth pairs and a bridge built by hand, network namespaces as rooms, and nsenter into a Docker container’s room.

Netfilter 자리에 걸린 함수 둘과 해시 테이블 하나로 연결을 5-tuple 로 기억하는 커널 모듈. 방화벽의 ESTABLISHED 판정과 NAT 의 답장 되돌리기가 이 테이블 위에서 성립한다.

리눅스 커널 IP 경로의 정해진 다섯 지점에서, 등록된 함수를 순서대로 불러 패킷을 검사·수정·폐기하게 하는 커널 프레임워크. iptables, nftables, conntrack 이 이 위에 올라간다.