Kubernetes Networking Explained: From ClusterIP to Cilium Service Mesh

Most Kubernetes tutorials skip what happens under the hood when you run kubectl expose. In fact, fewer than 10% of engineers can explain the mechanics behind it. Drawing from debugging networking issues at over 10 companies, I've identified the same recurring knowledge gaps: how ClusterIP really works, why Pods across namespaces can communicate by default, and what a CNI plugin does at the kernel level.

This guide bridges those gaps, offering a bottom-up understanding of Kubernetes networking—from Pod IP assignment to Cilium's eBPF-based service mesh. You'll learn how kube-proxy uses iptables for ClusterIP, how Ingress controllers route external traffic, how Network Policies secure micro-segmentation for SOC2 compliance, and why Cilium outperforms traditional approaches with speed, observability, and security. By the end, you'll be able to debug connectivity issues, implement default-deny policies, and choose the right CNI for your cluster.

Table of Contents

• What You'll Learn
• Prerequisites
• Part 1: Pod IPs and the Container Network Model
• Part 2: Services — ClusterIP, NodePort, and LoadBalancer
• Part 3: Ingress — External Traffic Routing
• Part 4: Network Policies — Micro-Segmentation
• Part 5: CNI Comparison — Cilium vs. Calico vs. Weave
• Conclusion and Next Steps

What You'll Learn

This tutorial demystifies Kubernetes networking, covering both foundational concepts and advanced implementations. By the end, you'll understand how Pod IPs work across nodes, how services provide stable endpoints, how Ingress controllers manage external access, and how Network Policies enforce security. You'll also compare CNI plugins like Cilium, Calico, and Weave, and gain insights into modern approaches using eBPF.

Prerequisites

This guide assumes you have a working Kubernetes cluster (either local or cloud-based) and basic familiarity with kubectl. No advanced networking knowledge is required—we'll explore each layer from the ground up.

Part 1: Pod IPs and the Container Network Model

Kubernetes assigns an IP address to each Pod, but these addresses are not inherently routable across nodes. This is where the Container Network Interface (CNI) comes in. CNI plugins like Calico, Flannel, and Cilium create a network overlay or use routing rules to ensure Pod IPs work cluster-wide. Understanding this underlying mechanism is critical for debugging connectivity issues.

Part 2: Services — ClusterIP, NodePort, and LoadBalancer

Services abstract Pod IPs to provide stable endpoints. ClusterIP, the default type, exposes a service on a cluster-internal IP. kube-proxy implements this using iptables rules (or utility proxies like IPVS) to forward traffic to backend Pods. NodePort and LoadBalancer extend access to external clients. Mastering these types helps you design scalable, resilient applications.

Part 3: Ingress — External Traffic Routing

Ingress controllers manage HTTP(S) traffic to services, routing requests based on host or path rules. Unlike a LoadBalancer, Ingress provides a single entry point, simplifying certificate management and routing. Popular controllers include NGINX, Traefik, and the now-standard Gateway API, which offers more flexibility and portability.

Part 4: Network Policies — Micro-Segmentation

Network Policies enable fine-grained traffic control between Pods, aligning with regulatory requirements like SOC2 CC6.1. By default, Pods accept all traffic, but you can enforce default-deny policies to restrict communication. This micro-segmentation reduces the attack surface and is essential for production environments.

Part 5: CNI Comparison — Cilium vs. Calico vs. Weave

Choosing the right CNI plugin depends on performance, security, and feature needs. Cilium leverages eBPF for high-performance networking and observability, making it a top choice for modern clusters. Calico is known for its simplicity and Network Policy support, while Weave provides easy setup but less control. Evaluate each against your use case to make an informed decision.

Conclusion and Next Steps

Kubernetes networking is complex, but a clear understanding of its layers—from Pod IPs to Cilium's service mesh—empowers you to debug efficiently and design secure systems. Start by experimenting with ClusterIP services and Network Policies in a test cluster. Then explore Cilium's eBPF features for advanced observability and performance tuning.

With 2026 advancements in Gateway API and eBPF, Kubernetes networking continues to evolve, making these skills more valuable than ever.

via FreeCodeCamp