github/awesome-kubernetes
1
0
Fork 0
mirror of https://github.com/nubenetes/awesome-kubernetes.git synced 2026-07-12 09:51:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
da96dbc08abcc644099a3b7e1e09ff2bd2dfdd60
awesome-kubernetes/v2-docs/kubernetes-networking.md

41 KiB
Raw Blame History

Kubernetes Networking

!!! tip "Nubenetes V2 Elite Portal" You are browsing the AI-Curated V2 Elite Edition. Looking for the exhaustive list of references? Check out the V1 Historical Archive.

!!! info "Architectural Context" Detailed reference for Kubernetes Networking in the context of Networking & Service Mesh.

Table of Contents

  1. Container Orchestration
  1. Infrastructure
  1. Kubernetes
  1. Networking
  1. Networking and Security

Container Orchestration

Kubernetes Networking (1)

Kube-Proxy

  • (2025) NFTables mode for kube-proxy in Kubernetes [GO CONTENT] [ADVANCED LEVEL] [COMMUNITY-TOOL] — Examines the transition of kube-proxy from traditional iptables and IPVS modes to the modern nftables backend in Kubernetes. Highlighting structural efficiency, the article explores how nftables reduces CPU-bound routing overhead and improves packet processing scalability in massive cluster environments.

Infrastructure

Networking

Comprehensive Guide

  • (2022) ==tkng.io: The Kubernetes Networking Guide 🌟🌟== [ADVANCED LEVEL] [DOCUMENTATION] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — An expansive, authoritative reference encyclopedia covering the entirety of the Kubernetes networking domain. Provides deep architectural insights into CNI interface contracts, CoreDNS resolutions, kube-proxy iptables or IPVS modes, and advanced routing patterns.

DNS

Performance Tuning

Deep Dive

Advanced Routing
Packet Flow
  • (2022) ==learnk8s.io: Tracing the path of network traffic in Kubernetes 🌟== [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] [GUIDE] — An exceptionally precise visual reconstruction tracing the physical path of network packets through container boundaries, virtual interfaces, iptables chains, and node boundaries. Invaluable reference for platform engineers tasked with isolating root causes of packet drops and latency spikes.

Evaluation

CNI Selection
  • (2022) itnext.io: Kubernetes networking deep dive: Did you make the right choice? [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — An engineering benchmark and comparison of leading Kubernetes CNI implementations (Calico, Cilium, Flannel). Evaluates raw throughput, CPU overhead, eBPF capabilities, and network policy performance to guide architects in making structural design choices.

Fundamentals

Service Topology

Ingress

Azure Application Gateway
Ingress Controllers
  • (2021) platform9.com: Ultimate Guide to Kubernetes Ingress Controllers 🌟 🌟🌟🌟🌟 [ENTERPRISE-STABLE] [GUIDE] — A definitive reference comparison comparing top ingress technologies (NGINX, Envoy, Traefik, HAProxy, Kong). Benchmarks each against raw throughput, latency profiles, dynamic reload capabilities, and extensibility models.
  • (2021) thenewstack.io: Ingress Controllers: The More the Merrier 🌟🌟🌟 [COMMUNITY-TOOL] — Presents strategic advantages of operating multiple distinct Ingress Controller classes side-by-side within a single cluster. Outlines traffic isolation patterns separating internal, public API, and corporate networks.
Overview
Performance at Scale
  • (2022) api7.ai: How Does APISIX Ingress Support Thousands of Pod Replicas? [ADVANCED LEVEL] 🌟🌟🌟🌟 [CASE STUDY] [ENTERPRISE-STABLE] — A detailed case study illustrating how the Apache APISIX Ingress Controller achieves near-instant configuration reloads in environments scaling up to thousands of active pod endpoints without increasing overall connection latency.
gRPC and HTTP2
  • (2021) openshift.com: gRPC or HTTP/2 Ingress Connectivity in OpenShift 🌟 [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Examines methods to secure and optimize high-throughput gRPC and HTTP/2 flows through OpenShift and Kubernetes ingress endpoints. Outlines router parameter optimizations and ALPN negotiation configurations to support low-latency microservice interfaces.

Load Balancing

Decentralized
  • (2022) thenewstack.io: ZeroLB, a New Decentralized Pattern for Load Balancing [ADVANCED LEVEL] 🌟🌟🌟 [COMMUNITY-TOOL] — Introduces the architectural paradigm of ZeroLB, targeting the complete elimination of centralized software or hardware load balancers. Shifts proxy decisions directly onto local sidecars, minimizing hops and eliminating centralized single points of failure.
Global GSLB
  • (2021) cloud.redhat.com: Global Load Balancer Approaches 🌟 [ADVANCED LEVEL] 🌟🌟🌟🌟 [CASE STUDY] [ENTERPRISE-STABLE] — Highlights architectural approaches to implement Global Server Load Balancing (GSLB) models across heterogeneous multi-cloud or hybrid clusters. Covers DNS-based and Anycast solutions to facilitate high-availability failover paths.

Microservices

Inter-Service Communication

Routing and Topology

Topology Aware Routing

Security

Egress Traffic
  • (2019) ==monzo.com: Controlling outbound traffic from Kubernetes== [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [CASE STUDY] [DE FACTO STANDARD] — Details the technical execution of isolating and managing external network endpoints from within a production Kubernetes banking cluster. Features strategies on proxy security, dynamic firewall rule sets, and compliance monitoring.
Intent-Based Access Control
Network Policies
Packet Management

Kubernetes

Networking (1)

Architecture

  • (2021) stackrox.com: Kubernetes Networking Demystified: A Brief Guide [COMMUNITY-TOOL] [GUIDE] — This reference guide deconstructs core Kubernetes networking patterns: container-to-container, pod-to-pod, pod-to-service, and external access mechanisms. It explains the mechanics of CNI plugins, IPAM allocations, iptables/IPVS load balancing, and dynamic ingress mapping.

Networking (2)

CNI

Cilium

Core Services

DNS (1)

  • (2021) blog.cloudsigma.com: Kubernetes DNS Service: A Beginner’s Guide [LEGACY] — This reference details the mechanics of Kubernetes cluster DNS architectures. It contrasts legacy kube-dns limitations with CoreDNS performance, explaining service discovery configurations, search paths, and DNS forwarding profiles essential for microservice visibility.

Ingress and Gateway

Automation

  • (2021) github.com/stakater/Xposer ⭐ 32 [GO CONTENT] 🌟 [COMMUNITY-TOOL] — A lightweight automation operator designed to monitor services and dynamically generate DNS-mapped Ingress resources to reduce manual administrative overhead.

Contour

  • (2021) trstringer.com: Kubernetes Ingress with Contour [COMMUNITY-TOOL] — Implementation guide for Contour, an Envoy-driven Ingress controller. Focuses on the performance and security advantages of Contour's custom HTTPProxy API, which mitigates cross-namespace vulnerability risks inherent to standard ingress.

Controllers

  • (2021) InGate: Ingress & Gateway API Controller (Archived) ⭐ 728 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟 [LEGACY] — Architectural prototype designed to test Ingress integration patterns. Live engineering truth confirms this repository is archived by SIG-Network, as development has shifted entirely toward the standardized Gateway API.

Fundamentals (1)

Gateway API

  • (2023) Kubernetes Gateway API ⭐ 2885 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Official GitHub repository for the standard Kubernetes Gateway API. This next-generation specification supersedes standard Ingress, offering expressive, role-oriented, and extensible routing APIs (Gateway, GatewayClass, and Route resources).
  • (2026) gateway-api.sigs.k8s.io 🌟 [ADVANCED LEVEL] [DOCUMENTATION] [COMMUNITY-TOOL] — The main documentation site for the Gateway API. Serves as the ultimate authority on advanced routing concepts, conformance testing, and controller implementation guidelines.
  • (2022) armosec.io: The New Kubernetes Gateway API and Its Use Cases [COMMUNITY-TOOL] — A security-oriented overview mapping out real-world use cases for the Gateway API, including automated traffic-splitting, multi-tenant network partitioning, and robust ingress access control.
  • (2022) navendu.me: Comparing Kubernetes Gateway and Ingress APIs [COMMUNITY-TOOL] — Technical comparison detailing the structural design changes between Ingress and Gateway APIs. Illustrates how Gateway API handles service-mesh integrations and layer-7 routing logic.
  • (2021) kubernetes.io: Evolving Kubernetes networking with the Gateway API [COMMUNITY-TOOL] — Official Kubernetes blog post detailing the evolutionary progression of network routing from standard Ingress to the extensible, role-based Gateway API framework.
  • (2021) thenewstack.io: Unifying Kubernetes Service Networking (Again) with the Gateway API 🌟 [COMMUNITY-TOOL] — A critical industry analysis discussing the reunification of layer 4 and layer 7 service networking. Highlights the collaborative benefits of separating cluster ops configurations from developer route manifests.

NGINX

  • (2021) ==NGINX Ingress Controller - v1.0.0== ⭐ 19494 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — Landmark v1.0.0 release of the community ingress-nginx controller. Highlights include compatibility with the GA ingress API specification, significant security enhancements, and optimized resource consumption.
  • (2022) devopscube.com: How to Setup Nginx Ingress Controller On Kubernetes – Detailed Guide 🌟 [COMMUNITY-TOOL] [GUIDE] — Deep-dive deployment playbook detailing how to install, configure, and manage the NGINX Ingress Controller. Includes instructions on utilizing Helm, routing traffic to dynamic backends, and handling TLS certificates.

Operations

Multi-Cluster

Cluster Mesh

Service Interconnect

WireGuard VPN

Security (1)

Implementation Under the Hood

Namespace Isolation

Network Policy

  • (2021) opensource.com: What you need to know about Kubernetes NetworkPolicy [COMMUNITY-TOOL] — An operational introduction to native NetworkPolicy resources. Clarifies how policies dynamically enforce L3/L4 firewall restrictions using selector matching, highlighting the differences between default-allow and default-deny ingress/egress patterns.
  • (2021) howtoforge.com: Network Policy in Kubernetes 🌟 [COMMUNITY-TOOL] [GUIDE] — A clear, hands-on tutorial demonstrating how to enforce namespace-level isolation. Step-by-step instructions guide users through drafting rules to secure internal traffic.
  • (2021) bionconsulting.com: Kubernetes Network Policies [COMMUNITY-TOOL] — A rigorous, multi-part engineering reference detailing real-world enterprise NetworkPolicy patterns. Includes step-by-step debugging methodologies and ruleset templates.
  • (2020) learncloudnative.com: Kubernetes Network Policy [COMMUNITY-TOOL] — An introductory resource focused on the fundamentals of NetworkPolicy. Explains selector matching patterns and namespace encapsulation rules for cloud-native applications.

OpenShift

Recipes

  • (2021) ==ahmetb/kubernetes-network-policy-recipes 🌟== ⭐ 6144 [YAML CONTENT] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — The premier open-source repository for reusable NetworkPolicy templates. Provides validated configuration files to handle common cloud-native security patterns.

Zero Trust

Service Mesh

Linkerd and Cilium

Networking and Security

Kubernetes Networking (2)

Ingress and Traffic

  • (2021) containo.us: Kubernetes Ingress & Service API Demystified [MARKDOWN CONTENT] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Demystifies the inner workings of Kubernetes Services, endpoints, and Ingress routing rules. Compares how reverse-proxy solutions like Traefik process these API resources to dynamic configurations. Live Grounding validates that Traefik remains a popular, high-performance edge router in modern multi-tenant environments due to its automated Let's Encrypt and middleware options.
  • (2021) externalTrafficPolicy=local on kubernetes. How to preserve the source IP in kubernetes [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Addresses how setting the Kubernetes Service configuration externalTrafficPolicy: Local preserves client source IPs. Analyzes the associated trade-offs, such as potential uneven load distribution across endpoints. Live Grounding confirms that preserving source IP is crucial for zero-trust authorization, geolocation rules, and audit logging.
  • (2021) suse.com: NGINX Guest Blog: NGINX Kubernetes Ingress Controller 🌟 [MARKDOWN CONTENT] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Provides an overview of the NGINX Ingress Controller within the SUSE ecosystem, explaining how it maps incoming HTTP traffic to backend pods. Live Grounding shows that NGINX remains the most widely deployed Ingress Controller due to its reliability, ease of configuration, and rich community-supported annotations.
  • (2022) getenroute.io: Drive API Security At Kubernetes Ingress Using Helm And Envoy 🌟 [GO CONTENT] 🌟🌟🌟 [COMMUNITY-TOOL] — Enroute is a lightweight, Envoy-driven API gateway and Ingress Controller designed to secure microservices at the cluster boundary. Highlights integration with Helm and declarative custom resource configurations. Live Grounding indicates that while Envoy is standard, Enroute provides an accessible alternative for teams seeking simple, security-first ingress controls.
  • (2021) haproxy.com: Announcing HAProxy Kubernetes Ingress Controller 1.5 🌟 [GO CONTENT] 🌟🌟🌟 [COMMUNITY-TOOL] — Introduces features in HAProxy Ingress Controller 1.5, including support for Mutual TLS (mTLS), performance improvements, and certificate management. Live Grounding confirms HAProxy is highly reliable for high-throughput enterprise systems due to its lightweight resource footprints, low latency, and comprehensive traffic metrics.
  • (2021) devclass.com: HAProxy Ingress Controller 1.5 introduces mTLS support, gives load balancing experts more power [MARKDOWN CONTENT] 🌟🌟🌟 [COMMUNITY-TOOL] — Reviews the release of HAProxy Ingress Controller 1.5, highlighting security enhancements and client certificate verification support at the edge. Live Grounding validates that mTLS validation at the Ingress tier is a standard approach for offloading TLS termination from microservices while meeting zero-trust design requirements.
  • (2020) opensource.com: Why I use Ingress Controllers to expose Kubernetes services [MARKDOWN CONTENT] 🌟🌟🌟 [COMMUNITY-TOOL] — Argues the architectural benefits of utilizing an Ingress Controller for consolidated traffic entry rather than creating expensive cloud-provider LoadBalancer resources for every single microservice. Live Grounding confirms that using dynamic, routing-table based Ingress Controllers represents the standard cost-optimization strategy in enterprise cloud clusters.

Performance and Tuning

  • (2020) ==kubernetes.io: Scaling Kubernetes Networking With EndpointSlices== [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — Explains how the EndpointSlices API addresses the scalability issues of traditional Endpoints resources. Avoids sending large network update payloads across all cluster nodes by grouping endpoints. Live Grounding shows that EndpointSlices are crucial in large clusters with thousands of pods, keeping control plane traffic minimal.
  • (2021) blog.cloudflare.com: Moving k8s communication to gRPC [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — An insightful case study detailing Cloudflare's transition of internal microservices and Kubernetes cluster control-plane communications from traditional REST/JSON endpoints to high-performance gRPC over HTTP/2. Live Grounding shows that adopting gRPC significantly reduces CPU utilization and network latency across high-throughput distributed architectures.

Security and Hardening

  • (2020) blog.nody.cc: Verify your Kubernetes Cluster Network Policies: From Faith to Proof [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Focuses on validating network security policies using automated policy-verification and security-testing tools instead of assuming they work. Explains techniques for writing reliable assertions for ingress and egress rules. Live Grounding notes that modern 2026 enterprise teams actively integrate policy checkers (such as Sonobuoy, Cilium Hubble, or OPA) into CI/CD pipelines.

Load Balancing (1)

Performance and Tuning (1)

  • (2023) ==learnk8s.io: Load balancing and scaling long-lived connections in Kubernetes 🌟🌟🌟== [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — An exceptional, highly-detailed exploration of how Kubernetes handles long-lived connections such as gRPC, HTTP/2, and WebSockets. Analyzes why standard iptables-based kube-proxy L4 load balancing fails to distribute traffic evenly, causing backend starvation. Live Grounding highlights that resolving these issues requires client-side load balancing, proxy-assisted gRPC routing, or active connection-termination intervals.

💡 Explore Related: Cloudflare | Servicemesh | Web Servers

🔗 See Also: About | Postman

Reference in New Issue View Git Blame Copy Permalink