# Kubernetes Networking: Services, Ingress, and Network Policies

URL: https://www.devopsness.com/blog/kubernetes-networking-services-ingress-and-network-policies
Author: Kiril Urbonas
Published: 2026-02-13
Updated: 2026-02-13
Categories: DevOps
Tags: Kubernetes, Docker, Terraform

Summary: Understand Kubernetes networking: ClusterIP, NodePort, LoadBalancer, Ingress, and policy.

---
# Kubernetes Networking: Services, Ingress, and Network Policies

Kubernetes networking can be confusing. Here’s a concise guide to services, ingress, and network policy.

## Services

- **ClusterIP**: Internal cluster DNS; default for in-cluster traffic.
- **NodePort**: Expose a port on every node; good for dev or legacy.
- **LoadBalancer**: Cloud LB per service; use when you need a dedicated external IP.

## Ingress

- **Ingress** = HTTP(S) routing (host/path) to backend services. You need an **Ingress controller** (e.g. nginx, AWS ALB).
- **TLS**: Terminate at ingress; use cert-manager for certificates.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp
spec:
  ingressClassName: nginx
  rules:
    - host: myapp.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp
                port: { number: 80 }
```

## Network Policies

- **NetworkPolicy** restricts pod-to-pod and pod-to-external traffic. Default-deny and allow only what’s needed.
- Start with a policy that allows DNS and ingress; then add app-specific rules.

Best practice: document your ingress and network policy approach so every new service follows the same pattern.