IT 3300 : Virtualization

Kubernetes — Services & Networking

The networking rules

  • Every pod gets its own IP
  • Any pod can reach any other pod without NAT
  • But pods are disposable — their IPs change
  • So never target a pod IP directly

The problem a Service solves

  • A Deployment's pods come and go with changing IPs
  • Clients need one stable address for the group
  • A Service provides that stable endpoint + load balancing

How a Service finds pods

  • A Service selects pods by label (same idea as Deployments)
  • Any pod matching the selector is a backend
  • k8s load-balances across them and updates automatically as pods change

Service types

  • ClusterIP — internal-only stable IP (default)
  • NodePort — opens a fixed port on every node
  • LoadBalancer — external IP (cloud, or MetalLB on-prem)
  • ExternalName — maps to an external DNS name

A Service manifest

apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  selector:
    app: web
  ports:
    - port: 80
      targetPort: 80
  type: ClusterIP

Service DNS

  • Every Service gets a DNS name inside the cluster
  • Reach it as web (same namespace) or
    web.<namespace>.svc.cluster.local
  • Apps talk to services by name — never hardcode pod IPs

Inspecting services

  • kubectl get services
  • kubectl describe service web — see its endpoints (the pod IPs)
  • kubectl get endpoints web — the live backend list

Example clusterip

    wget https://it3300.cs.utahtech.edu/files/k8s-services-demo.yaml 
    kubectl apply -f k8s-services-demo.yaml
    kubectl -n svc-demo rollout status deployment/whoami
    kubectl -n svc-demo get pods,svc -o wide
    #temporary client
    kubectl -n svc-demo run client --rm -it --image=busybox:1.36 --restart=Never -- sh
    #inside client
    wget -qO- http://clusterip
    #and
    for i in 1 2 3 4 5 6 7 8; do
      wget -qO- http://clusterip | grep Hostname
    done

Example nodeport

    kubectl -n svc-demo get svc nodeport
    kubectl get nodes -o wide
    curl http://NODE_IP:NODE_PORT

Can access from any node ip address of the cluster

Example loadbalancer

    kubectl -n svc-demo get svc loadbalancer
    #this doesn't work unless we go to cloud

Example ExternalName - DNS Aliasing

Start the temporary client and

  • nslookup headless

You should see the individual IP addresses of the three Pods rather than one virtual Service IP.
When? Imagine your application runs inside Kubernetes, but PostgreSQL is hosted on AWS RDS.

    Application → mydb.abc123.us-east-1.rds.amazonaws.com

With ExternalName

    Application → database → mydb.abc123.us-east-1.rds.amazonaws.com

Our application just needs to connect to database:5432

Example

kubectl delete namespace svc-demo

But how do users outside get in?

  • ClusterIP is internal; NodePort is clunky; LoadBalancer needs a cloud
  • For HTTP(S), the clean answer is Ingress — next deck