@@ -9,58 +9,53 @@ description: >
99
1010The Kubernetes network model is built out of several pieces:
1111
12- * Each [ Pod] ( /docs/concepts/workloads/pods/ ) in a cluster gets its
13- own unique cluster-wide IP address.
14-
15- * A pod has its own private network namespace which is shared by
16- all of the containers within the pod. Processes running in
17- different containers in the same pod can communicate with each
18- other over `localhost`.
19-
20- * The _ pod network_ (also called a cluster network) handles communication
21- between pods. It ensures that (barring intentional network
22- segmentation):
23-
24- * All pods can communicate with all other pods, whether they are
25- on the same [ node] ( /docs/concepts/architecture/nodes/ ) or on
26- different nodes. Pods can communicate with each other
27- directly, without the use of proxies or address translation
28- (NAT).
29-
30- * (On Windows, this rule does not apply to host-network pods.)
31-
32- * Agents on a node (such as system daemons, or kubelet) can
33- communicate with all pods on that node.
34-
35- * The [ Service] ( /docs/concepts/services-networking/service/ ) API
36- lets you provide a stable (long lived) IP address or hostname for a service implemented
37- by one or more backend pods, where the individual pods making up
38- the service can change over time.
39-
40- * Kubernetes automatically manages
41- [ EndpointSlice] ( /docs/concepts/services-networking/endpoint-slices/ )
42- objects to provide information about the pods currently
43- backing a Service.
44-
45- * A service proxy implementation monitors the ` Service ` and
46- ` EndpointSlice ` objects, and programs the data plane to route
47- service traffic to its backends, by using operating system or
48- cloud provider APIs to intercept or rewrite packets.
49-
50- * The [ Gateway] ( /docs/concepts/services-networking/gateway/ ) API
51- (or its predecessor,
52- [ Ingress] ( /docs/concepts/services-networking/ingress/ ) ) allows
53- you to make Services accessible to clients that are outside the cluster.
54-
55- * A simpler, but less-configurable, mechanism for cluster
56- ingress is available via the Service API's [ `type:
57- LoadBalancer`] ( /docs/concepts/services-networking/service/#loadbalancer ) ,
58- when using a supported {{< glossary_tooltip term_id="cloud-provider">}}.
59-
60- * [ NetworkPolicy] ( /docs/concepts/services-networking/network-policies ) is a built-in
61- Kubernetes API that
62- allows you to control traffic between pods, or between pods and
63- the outside world.
12+ * Each [ pod] ( /docs/concepts/workloads/pods/ ) in a cluster gets its
13+ own unique cluster-wide IP address.
14+
15+ * A pod has its own private network namespace which is shared by
16+ all of the containers within the pod. Processes running in
17+ different containers in the same pod can communicate with each
18+ other over ` localhost ` .
19+
20+ * The _ pod network_ (also called a cluster network) handles communication
21+ between pods. It ensures that (barring intentional network segmentation):
22+
23+ * All pods can communicate with all other pods, whether they are
24+ on the same [ node] ( /docs/concepts/architecture/nodes/ ) or on
25+ different nodes. Pods can communicate with each other
26+ directly, without the use of proxies or address translation (NAT).
27+
28+ On Windows, this rule does not apply to host-network pods.
29+
30+ * Agents on a node (such as system daemons, or kubelet) can
31+ communicate with all pods on that node.
32+
33+ * The [ Service] ( /docs/concepts/services-networking/service/ ) API
34+ lets you provide a stable (long lived) IP address or hostname for a service implemented
35+ by one or more backend pods, where the individual pods making up
36+ the service can change over time.
37+
38+ * Kubernetes automatically manages
39+ [ EndpointSlice] ( /docs/concepts/services-networking/endpoint-slices/ )
40+ objects to provide information about the pods currently backing a Service.
41+
42+ * A service proxy implementation monitors the set of Service and
43+ EndpointSlice objects, and programs the data plane to route
44+ service traffic to its backends, by using operating system or
45+ cloud provider APIs to intercept or rewrite packets.
46+
47+ * The [ Gateway] ( /docs/concepts/services-networking/gateway/ ) API
48+ (or its predecessor, [ Ingress] ( /docs/concepts/services-networking/ingress/ ) )
49+ allows you to make Services accessible to clients that are outside the cluster.
50+
51+ * A simpler, but less-configurable, mechanism for cluster
52+ ingress is available via the Service API's
53+ [ ` type: LoadBalancer ` ] ( /docs/concepts/services-networking/service/#loadbalancer ) ,
54+ when using a supported {{< glossary_tooltip term_id="cloud-provider">}}.
55+
56+ * [ NetworkPolicy] ( /docs/concepts/services-networking/network-policies ) is a built-in
57+ Kubernetes API that allows you to control traffic between pods, or between pods and
58+ the outside world.
6459
6560In older container systems, there was no automatic connectivity
6661between containers on different hosts, and so it was often necessary
@@ -76,36 +71,35 @@ For the other parts, Kubernetes defines the APIs, but the
7671corresponding functionality is provided by external components, some
7772of which are optional:
7873
79- * Pod network namespace setup is handled by system-level software
80- implementing the [ Container Runtime
81- Interface] ( /docs/concepts/architecture/cri.md ) .
82-
83- * The pod network itself is managed by a [ pod network
84- implementation] ( /docs/concepts/cluster-administration/addons/#networking-and-network-policy ) .
85- On Linux, most container runtimes use the
86- {{< glossary_tooltip text="Container Networking Interface (CNI)" term_id="cni" >}}
87- to interact with the pod network implementation, so these
88- implementations are often called _ CNI plugins_ .
89-
90- * Kubernetes provides a default implementation of service proxying,
91- called {{< glossary_tooltip term_id="kube-proxy">}}, but some pod
92- network implementations instead use their own service proxy that
93- is more tightly integrated with the rest of the implementation.
94-
95- * NetworkPolicy is generally also implemented by the pod network
96- implementation. (Some simpler pod network implementations don't
97- implement NetworkPolicy, or an administrator may choose to
98- configure the pod network without NetworkPolicy support. In these
99- cases, the API will still be present, but it will have no effect.)
100-
101- * There are many [ implementations of the Gateway
102- API] ( https://gateway-api.sigs.k8s.io/implementations/ ) , some of
103- which are specific to particular cloud environments, some more
104- focused on "bare metal" environments, and others more generic.
74+ * Pod network namespace setup is handled by system-level software implementing the
75+ [ Container Runtime Interface] ( /docs/concepts/architecture/cri.md ) .
76+
77+ * The pod network itself is managed by a
78+ [ pod network implementation] ( /docs/concepts/cluster-administration/addons/#networking-and-network-policy ) .
79+ On Linux, most container runtimes use the
80+ {{< glossary_tooltip text="Container Networking Interface (CNI)" term_id="cni" >}}
81+ to interact with the pod network implementation, so these
82+ implementations are often called _ CNI plugins_ .
83+
84+ * Kubernetes provides a default implementation of service proxying,
85+ called {{< glossary_tooltip term_id="kube-proxy">}}, but some pod
86+ network implementations instead use their own service proxy that
87+ is more tightly integrated with the rest of the implementation.
88+
89+ * NetworkPolicy is generally also implemented by the pod network
90+ implementation. (Some simpler pod network implementations don't
91+ implement NetworkPolicy, or an administrator may choose to
92+ configure the pod network without NetworkPolicy support. In these
93+ cases, the API will still be present, but it will have no effect.)
94+
95+ * There are many [ implementations of the Gateway API] ( https://gateway-api.sigs.k8s.io/implementations/ ) ,
96+ some of which are specific to particular cloud environments, some more
97+ focused on "bare metal" environments, and others more generic.
10598
10699## {{% heading "whatsnext" %}}
107100
108- The [ Connecting Applications with Services] ( /docs/tutorials/services/connect-applications-service/ ) tutorial lets you learn about Services and Kubernetes networking with a hands-on example.
101+ The [ Connecting Applications with Services] ( /docs/tutorials/services/connect-applications-service/ )
102+ tutorial lets you learn about Services and Kubernetes networking with a hands-on example.
109103
110104[ Cluster Networking] ( /docs/concepts/cluster-administration/networking/ ) explains how to set
111105up networking for your cluster, and also provides an overview of the technologies involved.
0 commit comments