A deep technical walkthrough of how Kubernetes networking actually works at the packet level, traced through a live cluster using tcpdump, ip route, iptables-save, conntrack, and bpftool. Covers the full dataplane path: Pod network namespaces and veth pairs, the cni0 Linux bridge for same-node Pod-to-Pod traffic, and cross-node routing via VXLAN overlay (Flannel/Calico), BGP native routing (Calico), and eBPF/XDP (Cilium). Explains how kube-proxy implements Service ClusterIPs using DNAT and iptables probability chains, the scaling problem at 2,000+ Services (48,000+ rules evaluated linearly), and why large clusters switch to IPVS or Cilium eBPF. Includes a debugging toolkit (ip route, conntrack, tcpdump), a section on DNS as the hidden cause of 80% of networking issues with NodeLocal DNSCache as the fix, NetworkPolicy enforcement differences between Calico and Cilium, and a decision matrix for choosing between iptables, IPVS, and eBPF based on cluster scale.
