--- title: Kubernetes networking: service, kube-proxy, load balancing description: A deep dive into Kubernetes Service networking explains how ClusterIP, NodePort, and LoadBalancer service types work under the hood, walking through... canonical: https://daily.dev/posts/kubernetes-networking-service-kube-proxy-load-balancing-tfckrz4aa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kubernetes networking: service, kube-proxy, load balancing | daily.dev og:description: A deep dive into Kubernetes Service networking explains how ClusterIP, NodePort, and LoadBalancer service types work under the hood, walking through... og:url: https://daily.dev/posts/kubernetes-networking-service-kube-proxy-load-balancing-tfckrz4aa og:image: https://api.daily.dev/og/posts/TfCkrZ4aA.png og:image:alt: Kubernetes networking: service, kube-proxy, load balancing og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes networking: service, kube-proxy, load balancing **[LearnKube](https://daily.dev/sources/learnkube)** · 35 min read · 0 upvotes · 0 comments ## Summary A deep dive into Kubernetes Service networking explains how ClusterIP, NodePort, and LoadBalancer service types work under the hood, walking through kube-proxy's iptables rule generation, DNS resolution via CoreDNS, and how traffic is redirected from virtual service IPs to pod IPs. It covers advanced topics such as externalTrafficPolicy: Local for preserving client source IPs, the extra network hop introduced by intra-cluster load balancing, ProxyTerminatingEndpoints for graceful pod termination introduced before v1.26, and how CNIs like Azure CNI and AWS-CNI enable direct pod IP routing from cloud load balancers, bypassing NodePorts entirely. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does externalTrafficPolicy: Local affect traffic routing in a Kubernetes NodePort or LoadBalancer service? Setting externalTrafficPolicy: Local preserves the client's original source IP by skipping SNAT and only routing traffic to nodes that have a local pod for the service, avoiding the extra hop between nodes. The tradeoff is that traffic is dropped if a node has no local pod, load distribution can become uneven, and the load balancer needs an extra healthCheckNodePort check (every 60 seconds) to know which nodes have healthy pods. _daily.dev surfaces networking deep dives like this for engineers tuning Kubernetes traffic policies._ ### How does kube-proxy translate a Kubernetes Service ClusterIP to a pod IP using iptables? kube-proxy programs iptables NAT rules so that packets destined for a Service's ClusterIP are matched in the KUBE-SERVICES chain, forwarded to a per-service KUBE-SVC chain, and then DNAT'd to one of the pod IPs listed in per-endpoint KUBE-SEP chains using statistic mode random probability for roughly even distribution across pods. _engineers debugging Kubernetes traffic paths track deep-dives like this on daily.dev._ ### What is ProxyTerminatingEndpoints and how does it change pod termination behavior in Kubernetes before and after v1.26? Before v1.26, a pod marked terminating stopped serving traffic immediately; afterward, terminating pods are marked with both terminating and serving conditions, letting them keep processing existing connections until fully shut down while kube-proxy removes their IP from iptables to block new traffic, reducing dropped requests during rolling updates. _teams shipping rolling updates without dropped requests follow Kubernetes internals like this via daily.dev._ ## Similar posts on daily.dev - [Understanding Kubernetes Networking](https://daily.dev/posts/understanding-kubernetes-networking-oooxha7or) · cilium · 22 upvotes · 1 comments - [Kubernetes Networking Explained: From ClusterIP to Cilium Service Mesh](https://daily.dev/posts/kubernetes-networking-explained-from-clusterip-to-cilium-service-mesh-rhwqkcwdn) · freeCodeCamp · 4 upvotes · 0 comments - [Kubernetes Networking Explained Without the Hand-Waving](https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi) · Medium · 5 upvotes · 1 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#networking](https://daily.dev/tags/networking) [View this post on daily.dev](https://daily.dev/posts/kubernetes-networking-service-kube-proxy-load-balancing-tfckrz4aa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kubernetes networking: service, kube-proxy, load balancing","url":"https://daily.dev/posts/kubernetes-networking-service-kube-proxy-load-balancing-tfckrz4aa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-networking-service-kube-proxy-load-balancing-tfckrz4aa"},"datePublished":"2026-08-31T11:20:03.618Z","dateModified":"2026-08-31T11:20:29.216Z","description":"A deep dive into Kubernetes Service networking explains how ClusterIP, NodePort, and LoadBalancer service types work under the hood, walking through...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/862e9210a3958107695a89dbab226d81?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/862e9210a3958107695a89dbab226d81?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"LearnKube","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LearnKube","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/90786df1b5d44abb91a090a0b6c81517","url":"https://daily.dev/sources/learnkube"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kubernetes-networking-service-kube-proxy-load-balancing-tfckrz4aa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,networking","timeRequired":"PT35M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LearnKube","item":"https://daily.dev/sources/learnkube"},{"@type":"ListItem","position":3,"name":"Kubernetes networking: service, kube-proxy, load balancing"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kubernetes-networking-service-kube-proxy-load-balancing-tfckrz4aa#faq","mainEntity":[{"@type":"Question","name":"How does externalTrafficPolicy: Local affect traffic routing in a Kubernetes NodePort or LoadBalancer service?","acceptedAnswer":{"@type":"Answer","text":"Setting externalTrafficPolicy: Local preserves the client's original source IP by skipping SNAT and only routing traffic to nodes that have a local pod for the service, avoiding the extra hop between nodes. The tradeoff is that traffic is dropped if a node has no local pod, load distribution can become uneven, and the load balancer needs an extra healthCheckNodePort check (every 60 seconds) to know which nodes have healthy pods. daily.dev surfaces networking deep dives like this for engineers tuning Kubernetes traffic policies."}},{"@type":"Question","name":"How does kube-proxy translate a Kubernetes Service ClusterIP to a pod IP using iptables?","acceptedAnswer":{"@type":"Answer","text":"kube-proxy programs iptables NAT rules so that packets destined for a Service's ClusterIP are matched in the KUBE-SERVICES chain, forwarded to a per-service KUBE-SVC chain, and then DNAT'd to one of the pod IPs listed in per-endpoint KUBE-SEP chains using statistic mode random probability for roughly even distribution across pods. engineers debugging Kubernetes traffic paths track deep-dives like this on daily.dev."}},{"@type":"Question","name":"What is ProxyTerminatingEndpoints and how does it change pod termination behavior in Kubernetes before and after v1.26?","acceptedAnswer":{"@type":"Answer","text":"Before v1.26, a pod marked terminating stopped serving traffic immediately; afterward, terminating pods are marked with both terminating and serving conditions, letting them keep processing existing connections until fully shut down while kube-proxy removes their IP from iptables to block new traffic, reducing dropped requests during rolling updates. teams shipping rolling updates without dropped requests follow Kubernetes internals like this via daily.dev."}}]} ```