Understand Kubernetes networking: ClusterIP, NodePort, LoadBalancer, Ingress, and policy.

On this page

Kubernetes Networking: Services, Ingress, and Network Policies

Kubernetes networking can be confusing. Here’s a concise guide to services, ingress, and network policy.

Services #

ClusterIP: Internal cluster DNS; default for in-cluster traffic.
NodePort: Expose a port on every node; good for dev or legacy.
LoadBalancer: Cloud LB per service; use when you need a dedicated external IP.

Ingress #

Ingress = HTTP(S) routing (host/path) to backend services. You need an Ingress controller (e.g. nginx, AWS ALB).
TLS: Terminate at ingress; use cert-manager for certificates.

yaml.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp
spec:
  ingressClassName: nginx
  rules:
    - host: myapp.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp
                port: { number: 80 }

Network Policies #

NetworkPolicy restricts pod-to-pod and pod-to-external traffic. Default-deny and allow only what’s needed.
Start with a policy that allows DNS and ingress; then add app-specific rules.

Best practice: document your ingress and network policy approach so every new service follows the same pattern.

Kubernetes Networking: Services, Ingress, and Network Policies

Kubernetes Networking: Services, Ingress, and Network Policies

Services #

Ingress #

Network Policies #

Stay Updated

What We Learned Running Weekly Game Days on Our CI/CD Pipeline

A Pragmatic Multi-Region Strategy for Small Teams

More from DevOps

Pipeline Observability — Why CI Failures Don't Trigger Alerts (And Should)

Burn-Rate Alerting — The SLO Discipline That Prevents Alert Fatigue

Supply Chain Security — SBOMs, Attestation, and What to Actually Verify

Pipeline Observability — Why CI Failures Don't Trigger Alerts (And Should)

Burn-Rate Alerting — The SLO Discipline That Prevents Alert Fatigue

Supply Chain Security — SBOMs, Attestation, and What to Actually Verify

Argo Rollouts — Progressive Delivery Beyond Argo CD

Terraform Module Versioning and Shared Registries

Container Resource Limits — What They Actually Do at the Kernel Level

About Kiril Urbonas

You might have missed

AI Agents in DevOps: From Copilots to Autonomous Automation in 2025

Prompt Engineering Best Practices: Maximizing LLM Performance

Linux Performance Tuning for Containers and Kubernetes Nodes

Kubernetes Networking: Services, Ingress, and Network Policies

Services#

Ingress#

Network Policies#

Stay Updated

What We Learned Running Weekly Game Days on Our CI/CD Pipeline

A Pragmatic Multi-Region Strategy for Small Teams

More from DevOps

Pipeline Observability — Why CI Failures Don't Trigger Alerts (And Should)

Burn-Rate Alerting — The SLO Discipline That Prevents Alert Fatigue

Supply Chain Security — SBOMs, Attestation, and What to Actually Verify

About Kiril Urbonas

You might have missed

AI Agents in DevOps: From Copilots to Autonomous Automation in 2025

Prompt Engineering Best Practices: Maximizing LLM Performance

Linux Performance Tuning for Containers and Kubernetes Nodes

Services #

Ingress #

Network Policies #