https://kukie.tech/tags/networking/Recent content in Networking on HistoryHugoko-krMon, 02 Nov 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-05-1/Mon, 02 Nov 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-05-1/Kubernetes networking abstractions from the inside of the cluster — why a Service object existing and traffic actually flowing are two different facts separated by controllers and a node datapath, what a StatefulSet fixes (ordinal names, PVC, DNS) and what it does not (Pod IP), why Endpoints became EndpointSlice and how to read ready·serving·terminating, port vs targetPort vs containerPort, what NodePort’s Cluster and Local policies trade, how to tell whether iptables, nftables or Cilium eBPF is carrying your Services, and why Headless and ExternalName are Services without a virtual IP.https://kukie.tech/posts/network-k8s-04-3/Fri, 30 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-04-3/Having a path is not the same as being allowed to use it — a three-Pod lab (diagnostic, Go web server, PostgreSQL) shows what a NetworkPolicy really is: a per-Pod, per-direction allow list where both the sender’s egress door and the receiver’s ingress door must open, allow rules only add up, an empty selector, an empty list and an empty rule mean three different things, a hyphen in YAML decides AND versus OR, and the standard API stops at the TCP port while Cilium’s Envoy can refuse a single HTTP path with a 403.https://kukie.tech/posts/network-k8s-04-2/Wed, 28 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-04-2/How a Pod reaches a Pod that keeps changing — a three-node kind lab with Cilium as a plain CNI, how a Service’s virtual IP is rewritten to a real Pod IP by node rules at PREROUTING and OUTPUT, why the iptables chain says 1/4·1/3·1/2 and spreads connections rather than requests, how db becomes db.cn4.svc.cluster.local and what CoreDNS does with it, where search and ndots multiply queries, and what dual-stack actually changes in Pod, Service and EndpointSlice fields.https://kukie.tech/posts/network-k8s-04-1/Mon, 26 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-04-1/The Kubernetes network model read from the room up — why a Pod gets one IP and shares it across containers, the three rules every CNI must satisfy and where NAT still lives, how a Pod IP is born in two steps and dies only with the Pod, what kubelet actually does when it probes, and the /24-vs-/32 choice that decides whether the host sees every packet.https://kukie.tech/posts/network-k8s-03-2/Wed, 21 Oct 2026 10:00:00 +0900https://kukie.tech/posts/network-k8s-03-2/How a container’s room gets out — Docker’s network modes compared with real namespace numbers, inside/outside pairing by @ifN, docker0 joined to the NIC by routing and NAT, CNM vs CNI and one CNI plugin call, VXLAN overlay, and one Go server knocked on from four places: another container, the host, another machine, and a container sharing its room.https://kukie.tech/posts/network-k8s-03-1/Wed, 21 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-03-1/What a container actually is on an Ubuntu VM — three problems that VMs and containers each solve, the runtime stack from dockerd and kubelet down to runC, why runC vanishes and containerd-shim stays as the parent, the six namespaces and one cgroup directory seen through /proc.https://kukie.tech/posts/network-k8s-02-2/Fri, 16 Oct 2026 21:00:00 +0900https://kukie.tech/posts/network-k8s-02-2/What the Linux kernel does to a packet between the door and the socket, measured on an Ubuntu VM — counting the five Netfilter hooks, reading one conntrack entry and its state changes, DNAT to a Service-like address with kube-proxy’s random rule, MASQUERADE out of a namespace, a node as a router, an external SYN meeting 0.0.0.0 vs 127.0.0.1, and where eBPF plugs in.https://kukie.tech/posts/network-k8s-02-1/Fri, 16 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-02-1/Inside the Linux kernel on an Ubuntu VM — a Python server under strace, the same socket seen from ss and /proc, why FD 4 comes back four times, interfaces as doors and lo as a mirror, veth pairs and a bridge built by hand, network namespaces as rooms, and nsenter into a Docker container’s room.https://kukie.tech/posts/network-k8s-01-2/Mon, 12 Oct 2026 21:00:00 +0900https://kukie.tech/posts/network-k8s-01-2/The same packet leaves the host — why the subnet mask never travels, how default routes and BGP fill the routing tables, why ARP looks for the router’s MAC instead of the server’s, and how Service NAT and VXLAN rebuild all of it inside Kubernetes.https://kukie.tech/posts/network-k8s-01-1/Mon, 12 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-01-1/One curl request to a local Go server, captured on lo0 and taken apart byte by byte — layers and encapsulation, the TCP handshake and connection states, TLS 1.3 vs 1.2 with decryption, and UDP with ICMP rejections.https://kukie.tech/posts/kubernetes-patterns-24/Mon, 31 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-24/NetworkPolicy와 Istio AuthorizationPolicy로 파드 간 통신을 제한하는 방법. 기본 차단에서 시작해 필요한 경로만 허용한다.https://kukie.tech/posts/kubernetes-patterns-13/Wed, 22 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-13/동적으로 배치되는 Pod를 내부/외부에서 안정적으로 찾아가는 방법 — ClusterIP, NodePort, LoadBalancer, Ingress까지.https://kukie.tech/wiki/arp/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/arp/같은 LAN 안에서 IP 주소에 해당하는 MAC 주소를 알아내는 프로토콜. LAN 전체에 브로드캐스트로 묻고, 그 IP 의 주인만 답한다.https://kukie.tech/wiki/as/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/as/한 회사가 하나의 정책으로 운영하는 라우터와 IP 대역의 묶음. 전 세계에서 겹치지 않는 번호(ASN)를 받고, 다른 AS 와는 BGP 로 경로를 주고받는다.https://kukie.tech/wiki/bgp/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/bgp/AS(독립된 망) 끼리 ‘이 대역은 나를 거쳐 갈 수 있다’ 를 알려 주는 라우팅 프로토콜. 인터넷 라우터의 경로 표를 채우며, TCP 179 번 위에서 이웃끼리 대화한다.https://kukie.tech/wiki/cilium/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/cilium/eBPF 로 Pod 네트워크와 네트워크 정책, 서비스 로드 밸런싱, 통신 관측을 처리하는 CNI 플러그인. Hubble 로 누가 어디로 통신했고 왜 막혔는지 기록한다.https://kukie.tech/wiki/cni/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/cni/컨테이너가 만들어질 때 네트워크를 붙이는 방법을 정한 규격. 런타임이 플러그인 실행 파일을 부르고, 플러그인이 Pod 안에 인터페이스와 IP·경로를 만든다.https://kukie.tech/wiki/conntrack/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/conntrack/Netfilter 자리에 걸린 함수 둘과 해시 테이블 하나로 연결을 5-tuple 로 기억하는 커널 모듈. 방화벽의 ESTABLISHED 판정과 NAT 의 답장 되돌리기가 이 테이블 위에서 성립한다.https://kukie.tech/wiki/dhcp/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/dhcp/기기가 네트워크에 붙을 때 IP 주소·마스크·기본 게이트웨이·DNS 를 자동으로 받아 오는 프로토콜. 아직 IP 가 없는 상태에서 LAN 브로드캐스트로 시작한다.https://kukie.tech/wiki/lan/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/lan/라우터를 거치지 않고 MAC 주소만으로 프레임이 오가는 범위. 브로드캐스트가 닿는 범위와 같고, 라우터에서 끝난다.https://kukie.tech/wiki/netfilter/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/netfilter/리눅스 커널 IP 경로의 정해진 다섯 지점에서, 등록된 함수를 순서대로 불러 패킷을 검사·수정·폐기하게 하는 커널 프레임워크. iptables, nftables, conntrack 이 이 위에 올라간다.https://kukie.tech/wiki/subnet/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/subnet/IP 주소의 앞부분이 같은 주소들의 묶음. 마스크(/24)로 어디까지가 네트워크인지 정하고, 같은 서브넷이면 직접, 아니면 게이트웨이로 보낸다.https://kukie.tech/wiki/vlan/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/vlan/스위치 설정만으로 하나의 LAN 을 여러 LAN 으로 나누는 기술. 프레임에 12비트 VLAN 번호를 붙여 구분하고, VLAN 사이는 라우터를 거쳐야 한다.https://kukie.tech/wiki/vxlan/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/vxlan/Ethernet 프레임을 UDP 패킷에 통째로 넣어 IP 망 너머로 나르는 터널 기술. 24비트 VNI 로 가상 망을 구분하고, 쿠버네티스 CNI 가 노드 사이를 잇는 데 쓴다.