Networking
Networking
This domain tests Service discovery and traffic flow: ClusterIP, NodePort, LoadBalancer, headless Services, DNS, Ingress, CNI, and NetworkPolicy interaction. The exam asks you to trace a connection and identify the layer that drops it.
Services and endpoints
A Service selects Pods by labels and exposes a stable virtual IP. port is the Service port; targetPort is the container port. Endpoints, or EndpointSlices, contain only ready Pods unless publishNotReadyAddresses is set. ClusterIP is internal; NodePort allocates a port on every node; LoadBalancer requests an external load balancer from the cloud provider. Headless Services (clusterIP: None) return Pod IPs via DNS.
DNS, Ingress, policies
CoreDNS resolves service.namespace.svc.cluster.local. Ingress is an API object that needs an ingress controller to program a proxy; it routes HTTP host and path traffic to Services. NetworkPolicies select Pods and allow traffic by podSelector, namespaceSelector, and ports; they are enforced by the CNI, not kube-proxy.
Worked example
A client calls web.default.svc.cluster.local and times out, but the Pod IP responds. kubectl get endpoints web shows no addresses. The Service selector is app=web, while Pods carry app=frontend. Fix the selector. If endpoints exist but connections fail, compare port and targetPort and check a NetworkPolicy. DNS resolves the Service; kube-proxy programs rules; endpoints determine backends; policy can still deny the packet.
Traps
targetPort must match the container's listening port, not the Service port. A LoadBalancer Service stays pending without a cloud controller. Ingress does nothing without a controller. NetworkPolicy egress default-deny also blocks DNS if UDP and TCP 53 are not allowed.