Pod-to-Pod on the Same Node
How does a packet get from one Pod to another when both run on the same Node? Both draw from the Node podCIDR, so the destination is on-link and the source needs no gateway: ARP resolves the peer MAC through the cni0 bridge, which records the port that answer came in on. The data frame then crosses a veth pair and is switched out that one port at layer 2, with no NAT and no encapsulation anywhere, so the real source IP arrives intact.
Play the animation 4 steps, animated, best on a wide screen
Pod-to-Pod on the Same Node, step by step
-
Pod A and Pod B draw from the same Node subnet 10.244.1.0/24, so B is on-link. The route A finds for it carries no gateway: the frame will go straight onto the wire to B, with no router in between. What A still lacks is the MAC behind 10.244.1.6.
Play from step 1 -
A broadcasts an ARP request out eth0 asking who holds 10.244.1.6. The veth peer hands it to cni0, the Node Linux bridge, which learns the port A sits on and floods the request out every port but that one. B answers with a unicast reply carrying its MAC, and as that reply crosses cni0 the bridge learns the port B sits on too.
Play from step 2 -
With the MAC for B known and its port in the forwarding table, A sends the data frame as a unicast. It crosses the veth onto cni0, which now switches it out that one port instead of flooding. This is plain layer 2 forwarding inside the Node, so the packet never touches the physical NIC.
Play from step 3 -
B receives the packet with the source IP of A intact. Traffic addressed to a Pod IP is never rewritten: no SNAT, no DNAT, no overlay encapsulation, just one bridge hop between two veth ports. Every Pod IP is routable cluster-wide, which is the flat-network promise.
Play from step 4