All diagrams
Networking: Pod Networkingk8s 1.36

Pod IP and the veth Pair

What is a veth pair, and where does a Pod IP actually live? A veth pair is one virtual link with two ends, and in a Pod they stand in two different network namespaces: eth0 inside the Pod, and its peer in the Node root namespace, enslaved to the cni0 bridge and carrying no address of its own. The address sits on the Pod end because a namespace is what holds an address, which is why the pair and the IP are allocated per Pod and never per container.

Play the animation 5 steps, animated, best on a wide screen

Pod IP and the veth Pair diagram: A veth pair drawn as one link with two ends

Pod IP and the veth Pair, step by step

  1. One CNI ADD made this and exited. What it left is a single virtual link with two ends: eth0 stands inside the Pod network namespace and vethb3f8a2c7 stands in the Node root namespace. The @if2 after the host side name is the index of the other end.

    Play from step 1

  2. Of the two ends only the Pod end is configured with an address. Inside the namespace eth0 carries 10.244.1.5/24, and the host end carries none at all. An address belongs to a network namespace rather than to a cable or to a container, so the thing that has an address here is the Pod.

    Play from step 2

  3. The app sends, and the packet goes out eth0 because on the usual plugins that is the one interface in this namespace facing outward. It enters one end of the pair and leaves the other with no lookup and no decision in between. A veth pair is a point to point link and nothing more.

    Play from step 3

  4. The host end is put under cni0 as a bridge port, which is what master cni0 means. A port does not answer for anything, so it needs no address of its own, and the frame lands on the bridge rather than in the Node routing table. The address on this side belongs to cni0 instead, at 10.244.1.1.

    Play from step 4

  5. The runtime created this namespace, pause holds it and app joined it, so both of them stand on that one eth0 and answer on that one address. A second container does not bring a second pair and a second address with it. The unit the pair and the address are allocated to is the Pod.

    Play from step 5

Sources

Commands for this