--- title: Kubernetes Networking Explained Without the Hand-Waving description: A practical explanation of Kubernetes networking that covers the core guarantee (every pod gets a unique IP with direct reachability), why Services exist to... canonical: https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kubernetes Networking Explained Without the Hand-Waving | daily.dev og:description: A practical explanation of Kubernetes networking that covers the core guarantee (every pod gets a unique IP with direct reachability), why Services exist to... og:url: https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi og:image: https://api.daily.dev/og/posts/B9YsCwnGI.png og:image:alt: Kubernetes Networking Explained Without the Hand-Waving og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes Networking Explained Without the Hand-Waving **[Medium](https://daily.dev/sources/medium_js)** · 5 min read · 5 upvotes · 1 comments ## Summary A practical explanation of Kubernetes networking that covers the core guarantee (every pod gets a unique IP with direct reachability), why Services exist to provide stable virtual IPs over ephemeral pod IPs, how kube-proxy and iptables/IPVS/eBPF handle traffic redirection, the critical role CoreDNS plays in internal service discovery, how NetworkPolicies restrict pod-to-pod traffic (and why CNI plugin support matters), and how Ingress fits as the external entry point into the whole system. The author builds from first principles rather than spec documents, drawing on real debugging experience. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### why does kubernetes require every pod to have its own IP address that other pods can reach directly without NAT This flat, NAT-free addressing is the foundational guarantee Kubernetes networking relies on, because it lets pods be scheduled, moved, or scaled anywhere without the network model changing underneath them. Kubernetes itself does not implement this; it delegates the actual networking to whichever CNI plugin is installed, such as Calico, Cilium, or Flannel, and simply assumes the plugin honors the contract. _daily.dev surfaces explanations like this for engineers piecing together how kubernetes networking actually fits together._ ### why do kubernetes networkpolicies sometimes not actually block traffic between pods NetworkPolicies only take effect if the cluster's CNI plugin actually implements policy enforcement; some CNI plugins support it and some do not, so simply creating a NetworkPolicy resource does not guarantee traffic is restricted. Without enforcement, a compromised pod can still reach any other pod or namespace by default, since Kubernetes allows all pod-to-pod traffic unless something actively blocks it. _teams hardening cluster security can track networking gotchas like this one through daily.dev._ ### why is DNS such a common source of intermittent latency in kubernetes clusters CoreDNS sits on the critical path of nearly every internal request in a cluster, yet it is often monitored less rigorously than the application services it supports. When CoreDNS is under-provisioned or under memory pressure, the result is intermittent, hard-to-reproduce latency that looks mysterious until DNS is specifically investigated as the cause. _debugging elusive cluster latency issues is easier when engineers follow networking deep dives on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@cjbaccus** · 0 upvotes > This seems to almost always be the black hole for most Kubernetes admins. The whole concept that it is just handled by the cluster is why it becomes such a burden when something goes wrong, because no one intrinsically understands the underlying network. ## Similar posts on daily.dev - [Kubernetes Networking Explained: From ClusterIP to Cilium Service Mesh](https://daily.dev/posts/kubernetes-networking-explained-from-clusterip-to-cilium-service-mesh-rhwqkcwdn) · freeCodeCamp · 5 upvotes · 1 comments - [Understanding Kubernetes Networking](https://daily.dev/posts/understanding-kubernetes-networking-oooxha7or) · cilium · 22 upvotes · 1 comments - [What Is Kubernetes Networking?](https://daily.dev/posts/what-is-kubernetes-networking--1qghzles9) · Isovalent · 15 upvotes · 0 comments - [Inside the Packet: How Kubernetes Networking Actually Works at L3/L4](https://daily.dev/posts/inside-the-packet-how-kubernetes-networking-actually-works-at-l3-l4-mlktkkrux) · Container Journal · 1 upvotes · 0 comments - [Kubernetes Services Explained: ClusterIP, DNS, and EndpointSlices](https://daily.dev/posts/kubernetes-services-explained-clusterip-dns-and-endpointslices-eq8ewoonn) · Medium · 1 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#architecture](https://daily.dev/tags/architecture) [View this post on daily.dev](https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kubernetes Networking Explained Without the Hand-Waving","url":"https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi"},"datePublished":"2026-07-28T07:34:30.785Z","dateModified":"2026-09-14T08:54:35.294Z","description":"A practical explanation of Kubernetes networking that covers the core guarantee (every pod gets a unique IP with direct reachability), why Services exist to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d278a53f7434d2d1a282129e202fabd8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d278a53f7434d2d1a282129e202fabd8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"kubernetes,architecture","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Kubernetes Networking Explained Without the Hand-Waving"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi","comment":[{"@type":"Comment","text":"This seems to almost always be the black hole for most Kubernetes admins. The whole concept that it is just handled by the cluster is why it becomes such a burden when something goes wrong, because no one intrinsically understands the underlying network.","datePublished":"2026-07-29T08:31:21.381Z","url":"https://daily.dev/posts/B9YsCwnGI#c-UXLAAYAfi","author":{"@type":"Person","name":"Carl Baccus","url":"https://daily.dev/cjbaccus","image":"https://avatars.githubusercontent.com/u/1283307?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi#faq","mainEntity":[{"@type":"Question","name":"why does kubernetes require every pod to have its own IP address that other pods can reach directly without NAT","acceptedAnswer":{"@type":"Answer","text":"This flat, NAT-free addressing is the foundational guarantee Kubernetes networking relies on, because it lets pods be scheduled, moved, or scaled anywhere without the network model changing underneath them. Kubernetes itself does not implement this; it delegates the actual networking to whichever CNI plugin is installed, such as Calico, Cilium, or Flannel, and simply assumes the plugin honors the contract. daily.dev surfaces explanations like this for engineers piecing together how kubernetes networking actually fits together."}},{"@type":"Question","name":"why do kubernetes networkpolicies sometimes not actually block traffic between pods","acceptedAnswer":{"@type":"Answer","text":"NetworkPolicies only take effect if the cluster's CNI plugin actually implements policy enforcement; some CNI plugins support it and some do not, so simply creating a NetworkPolicy resource does not guarantee traffic is restricted. Without enforcement, a compromised pod can still reach any other pod or namespace by default, since Kubernetes allows all pod-to-pod traffic unless something actively blocks it. teams hardening cluster security can track networking gotchas like this one through daily.dev."}},{"@type":"Question","name":"why is DNS such a common source of intermittent latency in kubernetes clusters","acceptedAnswer":{"@type":"Answer","text":"CoreDNS sits on the critical path of nearly every internal request in a cluster, yet it is often monitored less rigorously than the application services it supports. When CoreDNS is under-provisioned or under memory pressure, the result is intermittent, hard-to-reproduce latency that looks mysterious until DNS is specifically investigated as the cause. debugging elusive cluster latency issues is easier when engineers follow networking deep dives on daily.dev."}}]} ```