<p>A few of our Pods access the Kubernetes API via the &quot;kubernetes&quot; Service. We're in the process of applying Network Policies which allow access to the K8S API, but the only way we've found to accomplish this is to query for the &quot;kubernetes&quot; Service's ClusterIP, and include it as an ipBlock within an egress rule within the Network Policy.</p>
<p>Specifically, this value:</p>
<pre><code>kubectl get services kubernetes --namespace default -o jsonpath='{.spec.clusterIP}'
</code></pre>
<p>Is it possible for the &quot;kubernetes&quot; Service ClusterIP to change to a value other than what it was initialized with during cluster creation? If so, there's a possibility our configuration will break. Our hope is that it's not possible, but we're hunting for official supporting documentation.</p>

Puma
<p>The short answer is no.</p>
<p>More details :</p>
<ul>
<li><p>You cannot change/edit clusterIP because it's immutable... so <code>kubectl edit</code> will not work for this field.</p>
</li>
<li><p>The service cluster IP can be changed easly by <code>kubectl delete -f svc.yaml</code>, then <code>kubectl apply -f svc.yaml</code> again.</p>
</li>
<li><p>Hence, never ever relies on service IP because services are designed to be referred by DNS :</p>
<ul>
<li>Use <code>service-name</code> if the communicator is inside the same namespace</li>
<li>Use <code>service-name.service-namespace</code> if the communicator is inside or outside the same namespace.</li>
<li>Use <code>service-name.service-namespace.svc.cluster.local</code> for FQDN.</li>
</ul>
</li>
</ul>
