Services & Networking
Service types
ClusterIP is a virtual IP reachable inside the cluster; NodePort exposes a port on every node; LoadBalancer asks a cloud/provider for an external LB; ExternalName returns a DNS CNAME. Services select Pods by labels and produce EndpointSlices. A headless Service (clusterIP: None) returns Pod IPs for stable discovery. kube-proxy or an eBPF dataplane programs forwarding.
DNS and ingress
CoreDNS resolves service.namespace.svc.cluster.local; short names work within the same namespace. Ingress is an HTTP routing API, not an implementation: an ingress controller and IngressClass must exist. NetworkPolicy is enforced by a CNI plugin that supports it; an empty podSelector selects all Pods in the namespace, and policies are additive allow rules.
Traps
A Service with no endpoints usually has a selector mismatch or unready Pods. targetPort must match the container port. NetworkPolicy default-deny requires both ingress and egress rules if you want to restrict both directions; namespaceSelector and podSelector combine in one peer. NodePort range is typically 30000-32767. Ingress TLS and host/path rules depend on controller behavior.
Worked example: allow only frontend Pods in namespace web to reach backend Pods on TCP 8080: create a NetworkPolicy in the backend namespace with podSelector app=backend, ingress from namespaceSelector matchLabels kubernetes.io/metadata.name=web and podSelector app=frontend, ports 8080. Verify with kubectl get endpoints and a test curl.