The Kubernetes Network Model
Every Pod receives its own routable IP address within the cluster without needing NAT:
- Pods on a node can communicate with all pods on all nodes without NAT.
- Agents on a node (kubelet) can communicate with all pods on that node.
CNI Implementations
- Cilium: Uses Linux eBPF in kernel space, bypassing iptables for sub-millisecond pod routing and L7 security.
- Calico: BGP-based routing with flexible NetworkPolicy enforcement.
Personal engineering field notes compiled from production systems. Patterns and benchmarks are updated as runtimes evolve.