<p>I have a Kubernetes cluster with the followings:</p>
<ul>
<li>A deployment of some demo web server</li>
<li>A ClusterIP service that exposes this deployment pods</li>
</ul>
<p>Now, I have the cluster IP of the service:</p>
<pre><code>NAME            TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
kubernetes      ClusterIP   10.96.0.1      &lt;none&gt;        443/TCP   5d3h
svc-clusterip   ClusterIP   10.98.148.55   &lt;none&gt;        80/TCP    16m
</code></pre>
<p>Now I can see that I can access this service from the host (!) - not within a Pod or anything:</p>
<pre><code>$ curl 10.98.148.55
Hello world ! Version 1
</code></pre>
<p>The thing is that I'm not sure if this capability is part of the definition of the ClusterIP service - i.e. is it guaranteed to work this way no matter what network plugin I use, or is this plugin-dependant.</p>
<p>The <a href="https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types" rel="nofollow noreferrer">Kubernetes docs</a> state that:</p>
<blockquote>
<p>ClusterIP: Exposes the Service on a cluster-internal IP. Choosing this value makes the Service only reachable from within the cluster. This is the default ServiceType</p>
</blockquote>
<p>It's not clear what is meant by &quot;within the cluster&quot; - does that mean within a container (pod) in the cluster? or even from the nodes themselves as in the example above?</p>

<blockquote>
<p>does that mean within a container (pod) in the cluster? or even from the nodes themselves</p>
</blockquote>
<p>You can access the ClusterIP from KubeNode and pods. This IP is a virtual IP, and It only works within the cluster. One way it works is ( apart from CNI), Using Linux kernel's <code>iptables</code>/<code>IPVS</code> feature it rewrites the packet with Pod IP address and Load balances among the pods. These rules are maintained by <code>KubeProxy</code></p>
