Services and Networking

---

1 - Introduction to Kubernetes Networking

Networking in Kubernetes is based on several fundamental principles:

Basic principles

Principle	Description
Unique IP per Pod	Each Pod has its own IP address
Direct communication	Pods can communicate without NAT
Flat network	All Pods are on the same logical network
CNI plugins	Networking is implemented by plugins

---

2 - Kubernetes Services

2.1 What is a Service?

A Service is an abstraction that defines a logical set of Pods and a policy for accessing them.

2.2 Service types

---

3 - ClusterIP

A Service accessible only inside the cluster.

# service-clusterip.yaml
apiVersion: v1
kind: Service
metadata:
  name: backend-service
spec:
  type: ClusterIP  # Par défaut
  selector:
    app: backend
  ports:
  - name: http
    port: 80         # Port du Service
    targetPort: 8080 # Port du conteneur
    protocol: TCP

# Créer le service
kubectl apply -f service-clusterip.yaml

# Vérifier
kubectl get svc backend-service

# Output:
# NAME              TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
# backend-service   ClusterIP   10.96.45.123   <none>        80/TCP    5s

# Accès depuis un Pod
kubectl run test --rm -it --image=busybox -- wget -qO- http://backend-service

Internal DNS

Services are accessible via DNS:

<service-name>.<namespace>.svc.cluster.local

# Exemples de résolution DNS
backend-service                          # Même namespace
backend-service.default                  # Namespace default
backend-service.default.svc.cluster.local  # FQDN complet

---

4 - NodePort

Exposes the Service on a static port on each Node.

# service-nodeport.yaml
apiVersion: v1
kind: Service
metadata:
  name: frontend-service
spec:
  type: NodePort
  selector:
    app: frontend
  ports:
  - port: 80
    targetPort: 8080
    nodePort: 30080  # 30000-32767, optionnel

# Accès externe
curl http://<NODE_IP>:30080

# Avec Minikube
minikube service frontend-service --url

---

5 - LoadBalancer

Provisions an external load balancer (cloud providers).

# service-loadbalancer.yaml
apiVersion: v1
kind: Service
metadata:
  name: web-service
  annotations:
    # Annotations spécifiques au cloud
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
spec:
  type: LoadBalancer
  selector:
    app: web
  ports:
  - port: 80
    targetPort: 8080

kubectl get svc web-service

# Output:
# NAME          TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)        AGE
# web-service   LoadBalancer   10.96.12.34    34.123.45.67     80:31234/TCP   1m

---

6 - ExternalName

Creates a DNS alias to an external service.

# service-externalname.yaml
apiVersion: v1
kind: Service
metadata:
  name: external-db
spec:
  type: ExternalName
  externalName: database.example.com

# Dans les Pods, "external-db" résout vers database.example.com
kubectl run test --rm -it --image=busybox -- nslookup external-db

---

7 - Endpoints and EndpointSlices

7.1 Automatic endpoints

# Les endpoints sont créés automatiquement
kubectl get endpoints backend-service

# Output:
# NAME              ENDPOINTS                                   AGE
# backend-service   10.244.1.5:8080,10.244.2.3:8080,...        5m

7.2 Manual endpoints (without selector)

# Pour pointer vers un service externe
apiVersion: v1
kind: Service
metadata:
  name: external-service
spec:
  ports:
  - port: 80
---
apiVersion: v1
kind: Endpoints
metadata:
  name: external-service
subsets:
- addresses:
  - ip: 192.168.1.100
  - ip: 192.168.1.101
  ports:
  - port: 8080

---

8 - Ingress

8.1 What is an Ingress?

An Ingress exposes HTTP/HTTPS Services outside the cluster with routing rules.

8.2 Installing an Ingress Controller

# NGINX Ingress Controller
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml

# Vérifier
kubectl get pods -n ingress-nginx
kubectl get svc -n ingress-nginx

8.3 Create an Ingress

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend-service
            port:
              number: 80
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

8.4 Ingress with TLS

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: secure-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls-secret
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend-service
            port:
              number: 80

# Créer le secret TLS
kubectl create secret tls app-tls-secret \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key

8.5 Multiple hosts

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-host-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: www.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: www-service
            port:
              number: 80
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

---

9 - Network Policies

9.1 Introduction

Network Policies control network traffic between Pods.

9.2 Basic Network Policy

# network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress
  
  ingress:
  # Autoriser le trafic depuis les Pods frontend
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
  
  egress:
  # Autoriser vers la base de données
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432
  # Autoriser DNS
  - to:
    ports:
    - protocol: UDP
      port: 53

9.3 Deny all by default

# Bloquer tout le trafic entrant
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}  # Tous les Pods
  policyTypes:
  - Ingress

---
# Bloquer tout le trafic sortant
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress

9.4 Allow from a namespace

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-monitoring
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: monitoring

---

10 - DNS in Kubernetes

10.1 CoreDNS

CoreDNS is the default DNS server for Kubernetes.

# Vérifier CoreDNS
kubectl get pods -n kube-system -l k8s-app=kube-dns
kubectl get svc -n kube-system kube-dns

10.2 DNS resolution

10.3 Custom DNS configuration

apiVersion: v1
kind: Pod
metadata:
  name: custom-dns
spec:
  containers:
  - name: app
    image: nginx
  dnsPolicy: "None"
  dnsConfig:
    nameservers:
    - 8.8.8.8
    - 8.8.4.4
    searches:
    - default.svc.cluster.local
    - svc.cluster.local
    options:
    - name: ndots
      value: "5"

---

11 - Service Mesh (overview)

For advanced networking features:

Solution	Characteristics
Istio	Complete, complex
Linkerd	Lightweight, simple
Consul Connect	HashiCorp

---

Summary

In this chapter, we learned:

• The Service types: ClusterIP, NodePort, LoadBalancer
• Configuring Ingress for HTTP/HTTPS routing
• Network Policies for network security
• How Kubernetes DNS works
• An overview of Service Meshes

---

Next step

In the next chapter, we will explore ConfigMaps and Secrets for configuration management.

→ Next chapter: ConfigMaps and Secrets

---

← Back to the table of contents