<p>When it comes to networking, I'm quite overwhelmed by the numerous concepts and options.
So my question is: What are the usecases and the differences between these kubernetes concepts?</p>
<ul>
<li><a href="https://kubernetes.io/docs/concepts/cluster-administration/networking/" rel="nofollow noreferrer">network model</a></li>
<li><a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/" rel="nofollow noreferrer">network plugin</a></li>
<li><a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">network policy</a></li>
</ul>
<p><strong>What I've found out so far:</strong></p>
<p>The documentation of network policy describes the usecase quite clear:</p>
<blockquote>
<p>you want to control traffic flow at the IP address or port level</p>
</blockquote>
<p>But Network Policy is not used consistently here: Calico is a <a href="https://kubernetes.io/docs/concepts/cluster-administration/networking/" rel="nofollow noreferrer">Networking Model in kubernetes doc</a> or a Network Policy in Azure Portal (s. image).</p>
<p><a href="https://i.stack.imgur.com/otvSh.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/otvSh.png" alt="Azure Networking" /></a></p>
<p>I suspect, that Azure uses the wrong term here.</p>
<p>But then I still do not understand the difference between model and plugin. Of course it's about managing communication between resources.</p>
<p>Why do I need two different concepts and two configuration options for managing network traffic?</p>

<p>There's several networking problems that addressed in Kubernetes:</p>
<ol>
<li>Container-to-Container communications</li>
<li>Pod-to-Pod communications</li>
<li>Pod-to-Service communications</li>
<li>External network-to-Service communications</li>
</ol>
<p>1st problem addressed in container runtime, rest(3rd and 4th covered by <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">services</a> which still depend on underlying network model) solved by Kubernetes network model.</p>
<p>Network model is high level description of how network in Kubernetes is supposed to work, that imposes 3 main requirements:</p>
<ul>
<li>Every Pod gets its own IP address</li>
<li>Pods on a Node can communicate with all Pods on all Nodes without NAT</li>
<li>Agents on a Node can communicate with all Pods on that Node</li>
</ul>
<p>This abstract model allows different implementations of actual network layer, for example default network implementation called <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#kubenet" rel="nofollow noreferrer">kubenet</a> or <a href="https://docs.projectcalico.org/about/about-calico" rel="nofollow noreferrer">Calico</a>, <a href="https://github.com/cilium/cilium" rel="nofollow noreferrer">Cilium</a>, etc.</p>
<p>Network plugin is basically anything that implements <a href="https://github.com/kubernetes/kubernetes/blob/v1.19.0/pkg/kubelet/dockershim/network/plugins.go#L54" rel="nofollow noreferrer">NetworkPlugin</a> interface. All network model implementations are actually network plugins, even <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#kubenet" rel="nofollow noreferrer">default one</a>. Of course you can set up <a href="https://github.com/containernetworking/plugins/tree/master/plugins/meta/portmap" rel="nofollow noreferrer">some</a> <a href="https://github.com/containernetworking/plugins/tree/master/plugins/meta/bandwidth" rel="nofollow noreferrer">additional</a> plugins for more features/control over network.</p>
<p>But why Azure mentions <code>Calico</code> as network policy? Well, network policies are implemented via network plugins and <code>kubenet</code>, <code>Calico</code> provide their own implementations of network policies.</p>
