Kubernetes Networking Cheat Sheet

Core Kubernetes networking concepts including Services, DNS, NetworkPolicies, and Ingress for controlling pod-to-pod traffic.

3 PagesAdvancedFeb 10, 2026

Service Types

How Kubernetes Services expose sets of pods.

ClusterIP- Default type, exposes the service on an internal-only cluster IP
NodePort- Exposes the service on a static port on every node's IP
LoadBalancer- Provisions an external cloud load balancer (requires cloud provider integration)
ExternalName- Maps a service to an external DNS name via a CNAME, no proxying involved

Service Manifest

Expose a Deployment's pods internally on port 80.

yaml

apiVersion: v1kind: Servicemetadata:  name: web-svcspec:  selector:    app: web  ports:    - protocol: TCP      port: 80      targetPort: 8080  type: ClusterIP

NetworkPolicy - Deny by Default

Restrict ingress traffic to only pods labeled 'role: frontend'.

yaml

apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:  name: allow-frontend-onlyspec:  podSelector:    matchLabels:      app: api  policyTypes:    - Ingress  ingress:    - from:        - podSelector:            matchLabels:              role: frontend      ports:        - protocol: TCP          port: 8080

Ingress Resource

Route external HTTP traffic to a service based on host/path.

yaml

apiVersion: networking.k8s.io/v1kind: Ingressmetadata:  name: web-ingress  annotations:    nginx.ingress.kubernetes.io/rewrite-target: /spec:  ingressClassName: nginx  rules:    - host: app.example.com      http:        paths:          - path: /            pathType: Prefix            backend:              service:                name: web-svc                port:                  number: 80

Cluster DNS

How service discovery works via CoreDNS.

Service FQDN- `<service>.<namespace>.svc.cluster.local` resolves to the ClusterIP
Pod DNS- `<pod-ip-dashed>.<namespace>.pod.cluster.local`, rarely used directly
CoreDNS- Default cluster DNS server, runs as a Deployment in kube-system
Headless service- `clusterIP: None`, DNS returns individual pod IPs directly, used for StatefulSets

Pro Tip

NetworkPolicies are additive and namespace-scoped with no CNI enforcing them by default — verify your CNI plugin (Calico, Cilium, etc.) actually supports NetworkPolicy, otherwise the manifests apply silently but do nothing.

Was this cheat sheet helpful?

Container Security Scanning Cheat Sheet

Kubernetes Storage (PV/PVC) Cheat Sheet

Explore Topics

#KubernetesNetworking#KubernetesNetworkingCheatSheet#DevOps#Advanced#ServiceTypes#ServiceManifest#NetworkPolicyDenyByDefault#IngressResource#Networking#Kubernetes#CheatSheet#SkillVeris

Sri Hayavadhana Info-Tech

Professional Web Designing Services