github/awesome-kubernetes
1
0
Fork 0
mirror of https://github.com/nubenetes/awesome-kubernetes.git synced 2026-07-12 18:00:37 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
f9e994778aacea0aed51d4f7ccded9c643a72121
awesome-kubernetes/v2-docs/kubernetes-networking.md

120 KiB
Raw Blame History

Kubernetes Networking

!!! info "Architectural Context" Detailed reference for Kubernetes Networking in the context of Networking & Service Mesh.

Table of Contents

  1. Architectural Foundations
  1. Container Orchestration
  1. Infrastructure
  1. Kubernetes
  1. Networking
  1. Networking and Security

Architectural Foundations

Kubernetes Tools

General Reference

Container Orchestration

Kubernetes Networking (1)

Kube-Proxy

  • (2025) NFTables mode for kube-proxy in Kubernetes [GO CONTENT] [ADVANCED LEVEL] [COMMUNITY-TOOL] — Examines the transition of kube-proxy from traditional iptables and IPVS modes to the modern nftables backend in Kubernetes. Highlighting structural efficiency, the article explores how nftables reduces CPU-bound routing overhead and improves packet processing scalability in massive cluster environments.

Infrastructure

Networking

Comprehensive Guide

  • (2022) ==tkng.io: The Kubernetes Networking Guide 🌟🌟== [ADVANCED LEVEL] [DOCUMENTATION] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — An expansive, authoritative reference encyclopedia covering the entirety of the Kubernetes networking domain. Provides deep architectural insights into CNI interface contracts, CoreDNS resolutions, kube-proxy iptables or IPVS modes, and advanced routing patterns.

DNS

Performance Tuning

Deep Dive

Advanced Routing
BGP Routing
Packet Flow
  • (2022) ==learnk8s.io: Tracing the path of network traffic in Kubernetes 🌟== [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] [GUIDE] — An exceptionally precise visual reconstruction tracing the physical path of network packets through container boundaries, virtual interfaces, iptables chains, and node boundaries. Invaluable reference for platform engineers tasked with isolating root causes of packet drops and latency spikes.
Service IP Allocation
  • (2021) itnext.io: Inspecting and Understanding k8s Service Network 🌟 [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — An advanced technical inquiry examining how virtual IP endpoints are generated and tracked by the control plane. Demonstrates how to probe node routing tables, iptables rule logs, and IPVS structures to map physical packets to real-time service endpoints.

Evaluation

CNI Selection
  • (2022) itnext.io: Kubernetes networking deep dive: Did you make the right choice? [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — An engineering benchmark and comparison of leading Kubernetes CNI implementations (Calico, Cilium, Flannel). Evaluates raw throughput, CPU overhead, eBPF capabilities, and network policy performance to guide architects in making structural design choices.

Fundamentals

Network Model
  • (2022) ==tkng.io/arch: THE KUBERNETES NETWORK MODEL 🌟🌟== [ADVANCED LEVEL] [DOCUMENTATION] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — A highly precise, deep-dive architectural dissection of the core Kubernetes networking design philosophy. It systematically charts port mappings, interface attachments, loopbacks, and CNI execution chains, demonstrating how flat networks are established and maintained over diverse node pools.
  • (2020) sookocheff.com: A Guide to the Kubernetes Networking Model 🌟 🌟🌟🌟🌟 [ENTERPRISE-STABLE] [GUIDE] — A foundational architectural analysis of the Kubernetes networking model. It unpacks the four primary communications vectors—container-to-container, pod-to-pod, pod-to-service, and external-to-service—and explains why the absolute requirement of 'IP-per-pod' simplifies routing compared to traditional port-mapping models.
On-Premises
  • (2021) nbailey.ca: Domesticated Kubernetes Networking 🌟🌟🌟 [COMMUNITY-TOOL] — An informative study outlining step-by-step methods for domesticating Kubernetes networking within non-cloud or home lab setups. Details bare-metal bridge interfaces, tunnel configurations, and manual CNI implementations without high-overhead public cloud API assistance.
Overview
Service Discovery
  • (2024) Kubernetes Services and Load Balancing Explained 🌟🌟🌟🌟 [ENTERPRISE-STABLE] [GUIDE] — A contemporary structural breakdown explaining how Kubernetes leverages service endpoints to build abstract load balancing layers. Reviews the operations of kube-proxy in writing local node routing rules and traces how traffic migrates from virtual endpoints to real pod ports.
Service Topology
Service Types
  • (2021) sysdig.com: Kubernetes Services: ClusterIP, Nodeport and LoadBalancer 🌟🌟🌟 [COMMUNITY-TOOL] [GUIDE] — An analytical guide to native Kubernetes service abstraction layers, mapping how the internal control plane links Service resources to running Pod IPs. Outlines configuration protocols and target patterns for ClusterIP, NodePort, and LoadBalancer configurations.

Ingress

Alternative Architectures
  • (2020) ungleich.ch: Building Ingress-less Kubernetes Clusters [ADVANCED LEVEL] 🌟🌟🌟 [COMMUNITY-TOOL] — Evaluates architectural patterns to design and run Kubernetes environments without standard L7 Ingress controllers. Employs direct BGP advertisements and IPv6-native routing to link external clients directly to target containers.
Evaluation (1)
  • (2022) blog.palark.com: Comparing Ingress controllers for Kubernetes 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Provides a comprehensive architectural analysis and evaluation of popular ingress solutions. Highlights feature readiness for HTTP/3, TLS passthrough paths, and standard authentication middleware integration.
Fundamentals (1)
  • (2021) itnext.io: Why and How of Kubernetes Ingress (and Networking) 🌟 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Deconstructs the underlying flow of external traffic traversing through Ingress controllers down to the target endpoints. Outlines why standard Layer 4 proxies fall short for advanced routing and explains how Layer 7 controllers dynamically reload configurations dynamically upon API changes.
  • (2021) searchitoperations.techtarget.com: Differences between Kubernetes Ingress vs. load balancer 🌟🌟🌟 [COMMUNITY-TOOL] — A practical reference manual comparing the performance cost and operational patterns of Layer 4 LoadBalancer services against Layer 7 Ingress Controllers. Evaluates routing mechanics, cost-efficiency, and feature capabilities to assist in key infrastructure selection phases.
Ingress Controllers
  • (2021) platform9.com: Ultimate Guide to Kubernetes Ingress Controllers 🌟 🌟🌟🌟🌟 [ENTERPRISE-STABLE] [GUIDE] — A definitive reference comparison comparing top ingress technologies (NGINX, Envoy, Traefik, HAProxy, Kong). Benchmarks each against raw throughput, latency profiles, dynamic reload capabilities, and extensibility models.
  • (2021) thenewstack.io: Ingress Controllers: The More the Merrier 🌟🌟🌟 [COMMUNITY-TOOL] — Presents strategic advantages of operating multiple distinct Ingress Controller classes side-by-side within a single cluster. Outlines traffic isolation patterns separating internal, public API, and corporate networks.
NGINX Config
  • (2021) loft.sh: Kubernetes NGINX Ingress: 10 Useful Configuration Options 🌟 🌟🌟🌟🌟 [ENTERPRISE-STABLE] [GUIDE] — Provides ten practical and essential tuning annotations for NGINX Ingress controllers. Addresses tuning buffer limits, client timeouts, custom headers, and rate limits to maximize safety and application performance in production.
Overview (1)
Performance at Scale
  • (2022) api7.ai: How Does APISIX Ingress Support Thousands of Pod Replicas? [ADVANCED LEVEL] 🌟🌟🌟🌟 [CASE STUDY] [ENTERPRISE-STABLE] — A detailed case study illustrating how the Apache APISIX Ingress Controller achieves near-instant configuration reloads in environments scaling up to thousands of active pod endpoints without increasing overall connection latency.
Security
  • (2022) armosec.io: Getting Started with Kubernetes Ingress | Ben Hirschberg 🌟🌟🌟 [COMMUNITY-TOOL] — An introductory, security-focused overview of the Kubernetes Ingress resource. Analyzes common configuration pitfalls that expose clusters to threat vectors and demonstrates simple hardening techniques to safeguard public route interfaces.
Security and TLS
  • (2021) devopscube.com: How To Configure Ingress TLS/SSL Certificates in Kubernetes 🌟🌟🌟🌟 [ENTERPRISE-STABLE] [GUIDE] — A tutorial guiding developers through TLS/SSL certificate generation, binding, and storage in ingress environments. Explains how to leverage native cert-manager pipelines to secure internet-facing applications automatically with Let's Encrypt certificates.
Tooling
  • (2022) ingressbuilder.jetstack.io 🌟🌟 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — An interactive utility created by Jetstack that aids in generating syntactic-proof configurations for Kubernetes Ingress resources. Automates cert-manager annotations and rewrite-target generation, limiting YAML drafting errors.
Tunnels
Tutorials
  • (2021) devopscube.com: Kubernetes Ingress Tutorial For Beginners 🌟 🌟🌟🌟🌟 [ENTERPRISE-STABLE] [GUIDE] — A detailed step-by-step tutorial addressing the installation and configuration of the NGINX Ingress controller. Focuses on setting up custom host routing rules, implementing path matching, and troubleshooting entry level ingress issues.
Under the Hood
  • (2022) community.ops.io: Kubernetes Ingress Controller. How does it work?= [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] [GUIDE] — A didactic, code-heavy walkthrough that creates a bare-minimum ingress controller from scratch in Bash. Demystifies the core control loop: querying the API server, filtering changes, and rebuilding configurations dynamically.
gRPC and HTTP2
  • (2021) openshift.com: gRPC or HTTP/2 Ingress Connectivity in OpenShift 🌟 [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Examines methods to secure and optimize high-throughput gRPC and HTTP/2 flows through OpenShift and Kubernetes ingress endpoints. Outlines router parameter optimizations and ALPN negotiation configurations to support low-latency microservice interfaces.

Load Balancing

Decentralized
  • (2022) thenewstack.io: ZeroLB, a New Decentralized Pattern for Load Balancing [ADVANCED LEVEL] 🌟🌟🌟 [COMMUNITY-TOOL] — Introduces the architectural paradigm of ZeroLB, targeting the complete elimination of centralized software or hardware load balancers. Shifts proxy decisions directly onto local sidecars, minimizing hops and eliminating centralized single points of failure.
Global GSLB
  • (2021) cloud.redhat.com: Global Load Balancer Approaches 🌟 [ADVANCED LEVEL] 🌟🌟🌟🌟 [CASE STUDY] [ENTERPRISE-STABLE] — Highlights architectural approaches to implement Global Server Load Balancing (GSLB) models across heterogeneous multi-cloud or hybrid clusters. Covers DNS-based and Anycast solutions to facilitate high-availability failover paths.
On-Premises (1)
  • (2021) itnext.io: Kubernetes Service Type LB for On Prem Deployments [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Addresses the challenge of hosting ServiceType: LoadBalancer endpoints within bare-metal and on-prem architectures. Outlines implementation paths using MetalLB and BGP route advertising to lease public IPs.

Microservices

Inter-Service Communication

Proxy Mechanics

Foundational Routing
  • (2022) cloudtechtwitter.com: Reverse Proxy vs. Forward Proxy: The Differences 🌟🌟🌟 [COMMUNITY-TOOL] — A conceptual guide detailing practical differences between reverse proxy architectures (used to route public calls to backends) and forward proxy architectures (used to govern egress paths). Clarifies their specific use cases within enterprise networking configurations.

Routing and Topology

Topology Aware Routing

Security (1)

Intent-Based Access Control
Network Policies
Packet Management

Kubernetes

Networking (1)

Architecture

  • (2021) stackrox.com: Kubernetes Networking Demystified: A Brief Guide [COMMUNITY-TOOL] [GUIDE] — This reference guide deconstructs core Kubernetes networking patterns: container-to-container, pod-to-pod, pod-to-service, and external access mechanisms. It explains the mechanics of CNI plugins, IPAM allocations, iptables/IPVS load balancing, and dynamic ingress mapping.

Networking (2)

CNI

Benchmarks

  • (2021) cilium.io: CNI Benchmark: Understanding Cilium Network Performance [ADVANCED LEVEL] [COMMUNITY-TOOL] — Deep-dive benchmark analysis highlighting performance differences between standard iptables implementations and eBPF-driven engines, with a focus on latency and CPU efficiency.
  • (2020) itnext.io: Benchmark results of Kubernetes network plugins (CNI) over 10Gbit/s network (Updated: August 2020) [ADVANCED LEVEL] [COMMUNITY-TOOL] — A deep architectural performance analysis measuring major Kubernetes Container Network Interface (CNI) plugins over a dedicated 10Gbit/s network interface. It systematically contrasts network latency, throughput, and CPU utilization overhead across options like Calico, Cilium, Flannel, and Weave. The study details how overlay encapsulation methods (VXLAN/Geneve) introduce significant processing taxes compared to native BGP/host-gw direct routing topologies.

Cilium

Comparison

Fundamentals (2)

  • (2026) ==github.com/containernetworking 🌟== [GO CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — The foundational GitHub organization hosting the official CNI specification, runtime engines, and core plugin binaries that drive the cloud-native ecosystem.
  • (2026) Kubernetes.io: Network Plugins [DOCUMENTATION] [COMMUNITY-TOOL] — The authoritative Kubernetes documentation outlining network plugin types. Defines the operational boundaries between kubenet deployments and standard Container Network Interface (CNI) environments.

Overlay Networks

  • (2026) ==Flannel== ⭐ 9475 [GO CONTENT] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — A highly stable, lightweight Layer 3 overlay CNI fabric designed specifically for simplified Kubernetes installations. It provisions a simple local agent on each cluster node to manage subnet allocations via etcd, supporting VXLAN and host-gw backends. While it lacks L7 traffic steering and NetworkPolicy parsing, its operational simplicity remains highly valuable for lightweight resource-constrained environments.

Scaling

  • (2020) mhmxs.blogspot.com: Autoscaling Calico Route Reflector topology in Kubernetes [ADVANCED LEVEL] [COMMUNITY-TOOL] — A deep engineering walkthrough for autoscaling Calico Route Reflector (RR) topologies in high-scale Kubernetes clusters. It addresses the routing table exhaustion and CPU bottlenecks associated with full-mesh node-to-node BGP routing by dynamically managing centralized Route Reflectors, maintaining high performance and operational stability as node counts grow.

Telco and Multi-Network

  • (2026) ==Damn== ⭐ 393 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] [LEGACY] — Nokia's DANM (Damn Another Network Manager) CNI designed to facilitate telco-grade multi-network interfaces per pod inside Kubernetes, with support for SR-IOV, IPVLAN, and MACVLAN. Curator Insight vs Live Grounding: Although originally positioned as a dynamic multitenancy interface for telco workloads, live telemetry confirms the repository is now archived and considered a legacy architecture, with modern deployments utilizing Multus CNI.

Certification

CKAD

  • (2021) itnext.io: CKAD Scenarios about Ingress and NetworkPolicy [COMMUNITY-TOOL] [GUIDE] — A practical collection of task-oriented scenarios specifically curated for Certified Kubernetes Application Developer (CKAD) candidates. Focuses on isolating resources using egress policies and routing incoming traffic via Ingress resources.

Core Architecture

Documentation

  • (2026) Kubernetes Networking [DOCUMENTATION] [COMMUNITY-TOOL] — The official documentation outlining the structural model of Kubernetes networking. Explains the baseline constraints and requirements for pod-to-pod, pod-to-service, and external communication, establishing the standard IP-per-pod allocation axiom. Crucial reference architecture for understanding how the core API expects CNIs to behaves before overlaying sophisticated network policies.

Core Services

DNS (1)

  • (2021) blog.cloudsigma.com: Kubernetes DNS Service: A Beginner’s Guide [LEGACY] — This reference details the mechanics of Kubernetes cluster DNS architectures. It contrasts legacy kube-dns limitations with CoreDNS performance, explaining service discovery configurations, search paths, and DNS forwarding profiles essential for microservice visibility.

kube-proxy

DNS (2)

Caching

  • (2026) ==NodeLocal DNSCache== ⭐ 3887 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — The Kubernetes Enhancement Proposal (KEP) and repository code outlining the deployment of a local DNS caching agent on each node. Running as a DaemonSet, NodeLocal DNSCache intercepts queries at a local loopback IP, bypassing heavy iptables conntrack entries and DNAT rules to reduce latencies and resolve UDP packet drop vulnerabilities.
  • (2020) Kubernetes Node Local DNS Cache [COMMUNITY-TOOL] — An analytical guide showcasing how to verify, configure, and measure performance gains of NodeLocal DNSCache in high-throughput clusters. Details configuration paths, fallback mechanisms, and troubleshooting steps to resolve configuration mismatches between DNS cache pods and system resolvers.

Global Load Balancing

  • (2026) k8gb.io [GO CONTENT] [ADVANCED LEVEL] [COMMUNITY-TOOL] — k8gb is a cloud-native Global Server Load Balancing (GSLB) operator designed to run within Kubernetes. It integrates CoreDNS with external DNS providers, enabling cross-region failover and geo-routing of incoming traffic directly from cluster ingresses without needing proprietary hardware controllers.

Guides

  • (2022) nslookup.io: The life of a DNS query in Kubernetes [COMMUNITY-TOOL] — A thorough, step-by-step structural visualization tracing a DNS resolution query from within a Kubernetes Pod. Explains the intersection of a container's /etc/resolv.conf, the DNS search parameters (ndots:5), iptables forwarding rules, and CoreDNS lookups, illustrating where latencies and packet-drops occur.

Ingress (1)

  • (2021) ungleich.ch: Making kubernetes kube-dns/CoreDNS publicly reachable [ADVANCED LEVEL] [COMMUNITY-TOOL] — A hands-on guide explaining how to expose internal Kubernetes DNS names outside the cluster network boundaries. It highlights potential ingress routing patterns and access control rules needed to allow external clients to query cluster service records safely without introducing security risks.

Monitoring

  • (2021) sysdig.com: How to monitor coreDNS 🌟 [COMMUNITY-TOOL] — A detailed monitoring primer for CoreDNS using Prometheus and Sysdig. Highlights core health metrics, including latency histograms, requests counters, cache hit ratios, and error response codes (such as NXDOMAIN and SERVFAIL), to prevent DNS resolution latency from degrading microservice discovery pathways.

Service Discovery (1)

  • (2021) thenewstack.io: Supercharge CoreDNS with Cluster Addons 🌟 [COMMUNITY-TOOL] — Explains how to optimize and expand CoreDNS utilizing custom cluster addons and selective plugin combinations. Details core performance profiles and caching methodologies to supercharge name resolution in dense, highly dynamic cloud environments.

IPAM

Software-Defined

Ingress and Gateway

Automation

  • (2021) github.com/stakater/Xposer ⭐ 32 [GO CONTENT] 🌟 [COMMUNITY-TOOL] — A lightweight automation operator designed to monitor services and dynamically generate DNS-mapped Ingress resources to reduce manual administrative overhead.

Contour

  • (2021) trstringer.com: Kubernetes Ingress with Contour [COMMUNITY-TOOL] — Implementation guide for Contour, an Envoy-driven Ingress controller. Focuses on the performance and security advantages of Contour's custom HTTPProxy API, which mitigates cross-namespace vulnerability risks inherent to standard ingress.

Controllers

  • (2021) InGate: Ingress & Gateway API Controller (Archived) ⭐ 728 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟 [LEGACY] — Architectural prototype designed to test Ingress integration patterns. Live engineering truth confirms this repository is archived by SIG-Network, as development has shifted entirely toward the standardized Gateway API.

Fundamentals (3)

Gateway API

  • (2023) Kubernetes Gateway API ⭐ 2885 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Official GitHub repository for the standard Kubernetes Gateway API. This next-generation specification supersedes standard Ingress, offering expressive, role-oriented, and extensible routing APIs (Gateway, GatewayClass, and Route resources).
  • (2026) gateway-api.sigs.k8s.io 🌟 [ADVANCED LEVEL] [DOCUMENTATION] [COMMUNITY-TOOL] — The main documentation site for the Gateway API. Serves as the ultimate authority on advanced routing concepts, conformance testing, and controller implementation guidelines.
  • (2022) armosec.io: The New Kubernetes Gateway API and Its Use Cases [COMMUNITY-TOOL] — A security-oriented overview mapping out real-world use cases for the Gateway API, including automated traffic-splitting, multi-tenant network partitioning, and robust ingress access control.
  • (2022) navendu.me: Comparing Kubernetes Gateway and Ingress APIs [COMMUNITY-TOOL] — Technical comparison detailing the structural design changes between Ingress and Gateway APIs. Illustrates how Gateway API handles service-mesh integrations and layer-7 routing logic.
  • (2021) kubernetes.io: Evolving Kubernetes networking with the Gateway API [COMMUNITY-TOOL] — Official Kubernetes blog post detailing the evolutionary progression of network routing from standard Ingress to the extensible, role-based Gateway API framework.
  • (2021) thenewstack.io: Unifying Kubernetes Service Networking (Again) with the Gateway API 🌟 [COMMUNITY-TOOL] — A critical industry analysis discussing the reunification of layer 4 and layer 7 service networking. Highlights the collaborative benefits of separating cluster ops configurations from developer route manifests.

NGINX

  • (2021) ==NGINX Ingress Controller - v1.0.0== ⭐ 19494 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — Landmark v1.0.0 release of the community ingress-nginx controller. Highlights include compatibility with the GA ingress API specification, significant security enhancements, and optimized resource consumption.
  • (2022) devopscube.com: How to Setup Nginx Ingress Controller On Kubernetes – Detailed Guide 🌟 [COMMUNITY-TOOL] [GUIDE] — Deep-dive deployment playbook detailing how to install, configure, and manage the NGINX Ingress Controller. Includes instructions on utilizing Helm, routing traffic to dynamic backends, and handling TLS certificates.

Operations

Traefik

  • (2022) Transitioning from ingress-nginx to Traefik in Kubernetes [COMMUNITY-TOOL] — A migration blueprint walking developers through transitioning from ingress-nginx to Traefik. Details how Traefik's native middleware, dynamic routing, and CRDs simplify TLS management and traffic splitting in dynamic environments.

Multi-Cluster

Cluster Mesh

Service Interconnect

WireGuard VPN

Overlay Networks (1)

WireGuard VPN (1)

  • (2025) NetMaker ⭐ 11628 [GO CONTENT] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Netmaker is a high-speed, dynamic overlay network orchestrator powered by WireGuard. It facilitates direct, secure mesh networks across multi-cloud, on-premises, and edge Kubernetes nodes, drastically reducing latency compared to traditional overlay options like VXLAN or IPSec. Netmaker is highly valuable for hybrid cluster topologies and secure cross-regional communication.

Security (2)

Enterprise Solutions

  • (2026) tigera.io [ADVANCED LEVEL] [COMMUNITY-TOOL] — The commercial suite behind Project Calico, delivering enterprise-grade network security, active defense mechanisms, and unified policy management across multi-cloud and bare-metal environments. It adds microsegmentation, detailed observability dashboards, and compliance frameworks on top of standard open-source Calico capabilities to satisfy tight enterprise governance regulations.

GitOps

  • (2021) tigera.io: Enforcing Network Security Policies with GitOps – Part 1 (Calico + ArgoCD) [ADVANCED LEVEL] [COMMUNITY-TOOL] — A practical guide for implementing continuous security compliance by pairing Calico's declarative NetworkPolicies with ArgoCD. Explains how to construct an automated GitOps lifecycle pipeline to validate, audit, and push network enforcement rules directly from version-controlled files, preventing manual configuration drift on live clusters.

Implementation Under the Hood

Namespace Isolation

Network Policy

OpenShift

Policy Visualization

Recipes

  • (2021) ==ahmetb/kubernetes-network-policy-recipes 🌟== ⭐ 6144 [YAML CONTENT] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — The premier open-source repository for reusable NetworkPolicy templates. Provides validated configuration files to handle common cloud-native security patterns.

Zero Trust

Service Mesh

AWS Integration

  • (2023) dev.to/aws-builders: Amazon VPC Lattice — Build Applications, Not Networks [COMMUNITY-TOOL] — A deep dive into Amazon VPC Lattice, detailing how it decouples service communication networks from low-level VPC configuration constraints. It highlights the use of Lattice to manage traffic policies, authentication, and cross-cluster service-to-service communication with minimal operational overhead.

Linkerd and Cilium

Networking and Security

Kubernetes Networking (2)

Deep Dive (1)

??? abstract "Architect's Technical Comparison Table" | Solution | Maturity | Primary Focus | Language | Stars | | :--- | :--- | :--- | :--- | :--- | | speakerdeck.com: Kubernetes and networks. Why is this so dan hard? 🌟 | | Deep Dive | English | 🌟🌟🌟🌟🌟 | | ronaknathani.com: How a Kubernetes Pod Gets an IP Address 🌟 | | Deep Dive | Markdown | 🌟🌟🌟🌟🌟 | | dustinspecker.com: How Do Kubernetes and Docker Create IP Addresses?! | | Deep Dive | Markdown | 🌟🌟🌟🌟 | | altoros.com: Kubernetes Networking: How to Write Your Own CNI Plug-in with Bash | | Deep Dive | Bash | 🌟🌟🌟🌟 | | Network Node Manager | | Deep Dive | Go | 🌟🌟🌟 |

  • (2020) ==speakerdeck.com: Kubernetes and networks. Why is this so dan hard? 🌟== [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — An essential presentation deck by Tim Hockin (Kubernetes co-founder) exploring why cloud-native networking is complex and explaining the underlying decisions behind the pod-to-pod network design. Live Grounding confirms this slide deck is a legendary reference, outlining crucial design trade-offs regarding IPv4 exhaustion, NAT, routing engines, and Service VIPs.
  • (2020) ==ronaknathani.com: How a Kubernetes Pod Gets an IP Address 🌟== [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — An exquisite, step-by-step technical analysis of the process of container instantiation and network interface creation. Explores how the Kubelet invokes CNI plugins to assign an IP address. Live Grounding validates that understanding the low-level CNI specification and IPC interactions is crucial for debugging cluster networking bottlenecks.
  • (2021) dustinspecker.com: How Do Kubernetes and Docker Create IP Addresses?! [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — A deep technical investigation into the mechanics of Linux network namespaces, virtual ethernet pairs (veth), bridge interfaces, and IP routing rules. Demystifies how Docker and Kubernetes CNI plugins programmatically allocate IPs to containers. Live Grounding shows that understanding these low-level Linux primitives remains highly valuable for troubleshooting complex network packet drops.
  • (2020) altoros.com: Kubernetes Networking: How to Write Your Own CNI Plug-in with Bash [BASH CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] [GUIDE] — A fantastic, educational guide explaining how to write a simple CNI plugin from scratch using Bash. Demonstrates interface provisioning, IP allocation, and local host routing rules. Live Grounding shows that while not intended for production systems, this exercise demystifies the CNI specification and improves lower-level debugging skills.
  • (2024) Network Node Manager ⭐ 109 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟🌟 [COMMUNITY-TOOL] — A specialized network daemon developed by Kakao for optimizing node-level routing rules and handling network interfaces inside Kubernetes. Live Grounding shows that this utility targets bare-metal clusters, streamlining system-level network management while improving connectivity troubleshooting in on-premise cloud infrastructure.

Global Load Balancing (1)

  • (2024) K8GB - Kubernetes Global Balancer ⭐ 1 [GO CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — K8GB is a cloud-native, Kubernetes-native Global Server Load Balancing (GSLB) controller based on CoreDNS. Live Grounding indicates that K8GB is highly valued for coordinating traffic redirection across geographically distributed, multi-region clusters, enabling active-passive and active-active failover patterns without relying on proprietary hardware devices.

Ingress and Traffic

??? abstract "Architect's Technical Comparison Table" | Solution | Maturity | Primary Focus | Language | Stars | | :--- | :--- | :--- | :--- | :--- | | Learnk8s: Comparison of Kubernetes Ingress Controllers 🌟🌟 | | Ingress & Traffic | Markdown | 🌟🌟🌟🌟🌟 | | containo.us: Kubernetes Ingress & Service API Demystified | | Ingress & Traffic | Markdown | 🌟🌟🌟🌟 | | externalTrafficPolicy=local on kubernetes. How to preserve the source IP in kubernetes | | Ingress & Traffic | Markdown | 🌟🌟🌟🌟 | | thenewstack.io: HAProxy Kubernetes Ingress Controller Moves Outside the Cluster | | Ingress & Traffic | Markdown | 🌟🌟🌟🌟 | | suse.com: NGINX Guest Blog: NGINX Kubernetes Ingress Controller 🌟 | | Ingress & Traffic | Markdown | 🌟🌟🌟🌟 | | infoq.com: Kubernetes Ingress Is Now Generally Available | | Ingress & Traffic | Markdown | 🌟🌟🌟🌟 | | getenroute.io: Drive API Security At Kubernetes Ingress Using Helm And Envoy 🌟 | | Ingress & Traffic | Go | 🌟🌟🌟 | | ovh.com - getting external traffic into kubernetes: clusterip, nodeport, loadbalancer and ingress | | Ingress & Traffic | Markdown | 🌟🌟🌟 | | youtube: Kubernetes Ingress Explained Completely For Beginners | | Ingress & Traffic | English | 🌟🌟🌟 | | haproxy.com: Announcing HAProxy Kubernetes Ingress Controller 1.5 🌟 | | Ingress & Traffic | Go | 🌟🌟🌟 |

  • (2023) ==Learnk8s: Comparison of Kubernetes Ingress Controllers 🌟🌟== [MARKDOWN CONTENT] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — An expansive, community-maintained comparison spreadsheet detailing the feature matrices, protocol supports, dynamic reloading behaviors, and ecosystem integrations of various Ingress Controllers. Live Grounding highlights this dynamic reference as an essential resource for architects choosing ingress tools based on enterprise requirements.
  • (2021) containo.us: Kubernetes Ingress & Service API Demystified [MARKDOWN CONTENT] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Demystifies the inner workings of Kubernetes Services, endpoints, and Ingress routing rules. Compares how reverse-proxy solutions like Traefik process these API resources to dynamic configurations. Live Grounding validates that Traefik remains a popular, high-performance edge router in modern multi-tenant environments due to its automated Let's Encrypt and middleware options.
  • (2021) externalTrafficPolicy=local on kubernetes. How to preserve the source IP in kubernetes [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Addresses how setting the Kubernetes Service configuration externalTrafficPolicy: Local preserves client source IPs. Analyzes the associated trade-offs, such as potential uneven load distribution across endpoints. Live Grounding confirms that preserving source IP is crucial for zero-trust authorization, geolocation rules, and audit logging.
  • (2021) thenewstack.io: HAProxy Kubernetes Ingress Controller Moves Outside the Cluster [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Discusses the design choice of running HAProxy controllers outside the boundaries of the core Kubernetes cluster. Exposes cluster services to external networks while protecting control-plane components. Live Grounding confirms this topology is highly valued by security teams who prefer dedicated edge tiers separating internal cluster resources from the public internet.
  • (2021) suse.com: NGINX Guest Blog: NGINX Kubernetes Ingress Controller 🌟 [MARKDOWN CONTENT] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Provides an overview of the NGINX Ingress Controller within the SUSE ecosystem, explaining how it maps incoming HTTP traffic to backend pods. Live Grounding shows that NGINX remains the most widely deployed Ingress Controller due to its reliability, ease of configuration, and rich community-supported annotations.
  • (2020) infoq.com: Kubernetes Ingress Is Now Generally Available [MARKDOWN CONTENT] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — Reports on the milestone GA status of the networking.k8s.io/v1 Ingress API in Kubernetes 1.19, reflecting years of API maturity, path matching enhancements, and service port mappings. Live Grounding confirms that while Ingress remains widely used, the highly customizable Kubernetes Gateway API has emerged as the primary alternative for complex multi-tenant traffic routing.
  • (2022) getenroute.io: Drive API Security At Kubernetes Ingress Using Helm And Envoy 🌟 [GO CONTENT] 🌟🌟🌟 [COMMUNITY-TOOL] — Enroute is a lightweight, Envoy-driven API gateway and Ingress Controller designed to secure microservices at the cluster boundary. Highlights integration with Helm and declarative custom resource configurations. Live Grounding indicates that while Envoy is standard, Enroute provides an accessible alternative for teams seeking simple, security-first ingress controls.
  • (2021) ovh.com - getting external traffic into kubernetes: clusterip, nodeport, loadbalancer and ingress [MARKDOWN CONTENT] 🌟🌟🌟 [COMMUNITY-TOOL] — A comprehensive introductory guide explaining the four main methods of routing external traffic into a Kubernetes cluster: ClusterIP, NodePort, LoadBalancer, and Ingress. Compares routing efficiency and operational use cases. Live Grounding confirms this conceptual foundation is critical for engineering teams choosing between simple L4 load balancers and complex L7 ingress/gateway APIs.
  • (2021) youtube: Kubernetes Ingress Explained Completely For Beginners 🌟🌟🌟 [COMMUNITY-TOOL] — A visual, beginner-friendly video walkthrough explaining the purpose of an Ingress resource and an Ingress Controller in Kubernetes. Breaks down how HTTP requests find their way from external users to target microservice pods. Live Grounding confirms visual guides are highly effective for bootstrapping junior engineers onto complex cloud-native networking architectures.
  • (2021) haproxy.com: Announcing HAProxy Kubernetes Ingress Controller 1.5 🌟 [GO CONTENT] 🌟🌟🌟 [COMMUNITY-TOOL] — Introduces features in HAProxy Ingress Controller 1.5, including support for Mutual TLS (mTLS), performance improvements, and certificate management. Live Grounding confirms HAProxy is highly reliable for high-throughput enterprise systems due to its lightweight resource footprints, low latency, and comprehensive traffic metrics.
  • (2021) devclass.com: HAProxy Ingress Controller 1.5 introduces mTLS support, gives load balancing experts more power [MARKDOWN CONTENT] 🌟🌟🌟 [COMMUNITY-TOOL] — Reviews the release of HAProxy Ingress Controller 1.5, highlighting security enhancements and client certificate verification support at the edge. Live Grounding validates that mTLS validation at the Ingress tier is a standard approach for offloading TLS termination from microservices while meeting zero-trust design requirements.
  • (2020) opensource.com: Why I use Ingress Controllers to expose Kubernetes services [MARKDOWN CONTENT] 🌟🌟🌟 [COMMUNITY-TOOL] — Argues the architectural benefits of utilizing an Ingress Controller for consolidated traffic entry rather than creating expensive cloud-provider LoadBalancer resources for every single microservice. Live Grounding confirms that using dynamic, routing-table based Ingress Controllers represents the standard cost-optimization strategy in enterprise cloud clusters.

Performance and Tuning

  • (2020) ==kubernetes.io: Scaling Kubernetes Networking With EndpointSlices== [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — Explains how the EndpointSlices API addresses the scalability issues of traditional Endpoints resources. Avoids sending large network update payloads across all cluster nodes by grouping endpoints. Live Grounding shows that EndpointSlices are crucial in large clusters with thousands of pods, keeping control plane traffic minimal.
  • (2021) blog.cloudflare.com: Moving k8s communication to gRPC [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟 [ENTERPRISE-STABLE] — An insightful case study detailing Cloudflare's transition of internal microservices and Kubernetes cluster control-plane communications from traditional REST/JSON endpoints to high-performance gRPC over HTTP/2. Live Grounding shows that adopting gRPC significantly reduces CPU utilization and network latency across high-throughput distributed architectures.

Load Balancing (1)

Performance and Tuning (1)

  • (2023) ==learnk8s.io: Load balancing and scaling long-lived connections in Kubernetes 🌟🌟🌟== [MARKDOWN CONTENT] [ADVANCED LEVEL] 🌟🌟🌟🌟🌟 [DE FACTO STANDARD] — An exceptional, highly-detailed exploration of how Kubernetes handles long-lived connections such as gRPC, HTTP/2, and WebSockets. Analyzes why standard iptables-based kube-proxy L4 load balancing fails to distribute traffic evenly, causing backend starvation. Live Grounding highlights that resolving these issues requires client-side load balancing, proxy-assisted gRPC routing, or active connection-termination intervals.

💡 Explore Related: Cloudflare | Web Servers | Caching

Reference in New Issue View Git Blame Copy Permalink