Packet Classification by Destination
A Pod sends to one address, so which machinery picks the packet up? The destination decides, because in the default iptables proxy mode two stations stand between the Pod and the wire in a fixed order. The nat table owns the Service range and rewrites a Service address to a backend Pod, then the route lookup sorts the result into the Pod range, routed to the Node owning that slice, or into no cluster range, taken by the default route and masqueraded to the Node IP.
Play the animation 5 steps, animated, best on a wide screen
Packet Classification by Destination, step by step
-
A packet leaves the Pod carrying one destination and naming no machinery. In the default iptables proxy mode, two stations stand between it and the wire, in a fixed order, and only the second one is a routing decision. The nat table meets it first.
Play from step 1 -
The destination 10.96.0.20:80 is a Service address in the Service range, and the nat table holds a rule for it that rewrites it to a backend Pod address, 10.244.2.7:8080 on Node-2. What leaves this station is no longer addressed to a Service.
Play from step 2 -
The route lookup reads the rewritten address, which now sits inside the Pod range, and here that range is cut into a slice per Node. So the packet goes to the Node owning 10.244.2.0/24, with no further rewrite.
Play from step 3 -
A Pod addressing a Pod directly walks the same two stations in the same order. The nat table holds no rule for this address and passes it straight through, and the route lookup returns the very same verdict.
Play from step 4 -
1.1.1.1 falls in no cluster range, so the last resort takes it, the default route off the Node. The masquerade rules of the CNI plugin or ip-masq-agent keep the source for destinations in the non-masquerade ranges, the Pod range among them. 1.1.1.1 is in none of them, so the source becomes the Node IP.
Play from step 5