Flat Pod Network Model
What does Kubernetes promise about the network? The model is one flat address space: every Pod gets a cluster-unique IP, any Pod reaches any other Pod on any Node with no NAT so the real source IP is preserved barring intentional segmentation, and the model promises the Node agent the Pods on its own Node. Only a few parts of this live in the core, the container runtime implements the model, almost always through a CNI plugin like Calico, Cilium or Flannel.
Play the animation 5 steps, animated, best on a wide screen
Flat Pod Network Model, step by step
-
Rule one: every Pod gets its own IP, unique across the entire cluster. A Pod sees that same address as the one other Pods use to reach it, so there is no port mapping and no rewriting to reason about.
Play from step 1 -
Rule two: any Pod can reach any other Pod on any Node directly, with no NAT on the way, barring intentional segmentation such as a NetworkPolicy. The source address that arrives is the real Pod IP, here 10.244.1.5, even when the packet crosses to another Node.
Play from step 2 -
Same address space on one Node too. Pod 10.244.1.5 reaches its neighbour 10.244.1.6, both on Node-1, with the same flat addressing and no NAT. The traffic never leaves the Node, but to the Pods it is the very same model, no special case to reason about.
Play from step 3 -
Rule three is narrower, and it is about the guarantee and not the reach: the model promises the Kubelet only the Pods on its own Node. It talks to Pod 10.244.2.7 on Node-2 to run the network probes that say whether that Pod is live and ready. Other Nodes are outside the promise.
Play from step 4 -
Only a few parts of this live in the core. The container runtime on each Node implements the model, almost always through a CNI plugin such as Calico, Cilium or Flannel. Here the plugin lights up the whole fabric. Swap it and the model stays the same.
Play from step 5