Traffic into and inside the cluster

a plugin you never chose gives every pod a routable address the moment it starts, and swapping it re-plumbs the whole cluster.

Container Network Interface

pod traffic is wrapped inside another packet to cross the real network, and you lose a few percent of throughput to the wrapper.

Overlay network

you connect to a name rather than an address, and every workload in the cluster resolves it to whatever is currently healthy.

Cluster DNS

instances come and go constantly and callers never hold a stale address, because nobody is configured with one.

Service discovery

a controller keeps a live list of which instances are ready, and removing one from that list is what actually stops traffic.

Service endpoint

the address you connect to belongs to no machine at all; something on every node rewrites the packet to a real instance.

Virtual IP

the name resolves to every instance's own address instead of one virtual one, because the client wants to choose.

Headless service

the balancer picks a backend per TCP connection and never looks inside, so it cannot route on a path or retry a request.

Layer 4 load balancing

the proxy reads the request, routes on the path, retries the failed one on another backend and adds a trace header.

Layer 7 load balancing

the traffic crossing the boundary between the outside world and your platform, which is the part that has a certificate and a WAF.

North-south traffic

one internal service calling another, which is most of your packets and historically none of your authentication.

East-west traffic

traffic from outside arrives at one front door with the certificate on it, and is routed inwards by hostname and path.

Ingress

the routing rules you wrote in a manifest become a running proxy's configuration, reloaded a second or two after you apply them.

Ingress controller

your workload calling a payment provider goes out through something with a fixed address, because the provider allow-lists it.

Egress

everything leaving the cluster is funnelled through one hop, so there is one address to allow-list and one place to log it.

Egress gateway

the workload can reach only the three services it declared, and its attempt to open a connection anywhere else times out silently.

Network policy

the port is open in the application and the connection still hangs, because a rule two layers below never allowed it.

Security group

being inside the network gets a caller nothing; every call is authenticated and authorised on its own merits.

Zero-trust networking

every connection your service makes actually goes through a proxy in the same pod, which is where the retries and the TLS happen.

Sidecar proxy

five percent of requests go to the new version and the rest to the old, decided by the proxy rather than by your code.

Traffic splitting

the instance is taken out of rotation but its open connections are allowed to finish, instead of being cut mid-response.

Connection draining

private workloads reach the internet through a shared address, and you find the thing on your bill charging per gigabyte.

NAT gateway

two private networks can address each other directly without going near the internet, and neither one's address ranges may overlap.

VPC peering