<p>Can someone help me understand about the IP address I see for cluster IP when I list services.</p>

<ol>
<li>what is cluster IP (not the service type, but the real IP)?</li>
<li>how it is used?</li>
<li>where does it come from?</li>
<li>can I define the range for cluster IP (like we do for pod network)?</li>
</ol>

Sandeep kumar singh
<p>Good question to start learning something new (also for me):</p>

<p>Your concerns are related to <code>kube-proxy</code> by default in K8s cluster it's working in <code>iptables mode</code>.</p>

<p>Every node in a Kubernetes cluster runs a kube-proxy. Kube-proxy is responsible for implementing a form of virtual IP for Services.</p>

<blockquote>
  <p>In this mode, kube-proxy watches the Kubernetes control plane for the addition and removal of Service and Endpoint objects. For each Service, it installs iptables rules, which capture traffic to the Service’s clusterIP and port, and redirect that traffic to one of the Service’s backend sets. For each Endpoint object, it installs iptables rules which select a backend Pod.</p>
</blockquote>

<ol>
<li><p><a href="https://kubernetes.io/docs/concepts/overview/components/#kube-proxy" rel="nofollow noreferrer">Node components kube-proxy</a>:</p>

<ul>
<li>kube-proxy is a network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept.</li>
<li>kube-proxy maintains network rules on nodes. These network rules allow network communication to your Pods from network sessions inside or outside of your cluster.</li>
<li>kube-proxy uses the operating system packet filtering layer if there is one and it’s available. Otherwise, kube-proxy forwards the traffic itself.</li>
</ul></li>
</ol>

<p>As described <a href="https://itnext.io/an-illustrated-guide-to-kubernetes-networking-part-3-f35957784c8e" rel="nofollow noreferrer">here</a>:</p>

<blockquote>
  <p>Due to these iptables rules, whenever a packet is destined for a service IP, it’s DNATed (DNAT=Destination Network Address Translation), meaning the destination IP is changed from service IP to one of the endpoints pod IP chosen at random by iptables. This makes sure the load is evenly distributed among the backend pods.</p>
  
  <p>When this DNAT happens, this info is stored in conntrack — the Linux connection tracking table (stores 5-tuple translations iptables has done: protocol, srcIP, srcPort, dstIP, dstPort). This is so that when a reply comes back, it can un-DNAT, meaning change the source IP from the Pod IP to the Service IP. This way, the client is unaware of how the packet flow is handled behind the scenes.</p>
</blockquote>

<p>There are also different modes, you can find more information <a href="https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies" rel="nofollow noreferrer">here</a> </p>

<ol start="2">
<li><p>During cluster initialization you can use <code>--service-cidr</code> string parameter <code>Default: "10.96.0.0/12"</code></p>

<ul>
<li>ClusterIP: The IP address assigned to a Service</li>
</ul></li>
</ol>

<blockquote>
  <p>Kubernetes assigns a stable, reliable IP address to each newly-created Service (the ClusterIP) from the cluster's pool of available Service IP addresses. Kubernetes also assigns a hostname to the ClusterIP, by adding a DNS entry. The ClusterIP and hostname are unique within the cluster and do not change throughout the lifecycle of the Service. Kubernetes only releases the ClusterIP and hostname if the Service is deleted from the cluster's configuration. You can reach a healthy Pod running your application using either the ClusterIP or the hostname of the Service.</p>
</blockquote>

<ul>
<li>Pod IP: The IP address assigned to a given Pod. 

<blockquote>
  <p>Kubernetes assigns an IP address (the Pod IP) to the virtual network interface in the Pod's network namespace from a range of addresses reserved for Pods on the node. This address range is a subset of the IP address range assigned to the cluster for Pods, which you can configure when you create a cluster.</p>
</blockquote></li>
</ul>

<p>Resources:</p>

<ul>
<li><a href="https://supergiant.io/blog/understanding-kubernetes-kube-proxy/" rel="nofollow noreferrer">Iptables Mode</a> </li>
<li><a href="https://cloud.google.com/kubernetes-engine/docs/concepts/network-overview#services" rel="nofollow noreferrer">Network overview</a> </li>
<li><a href="https://supergiant.io/blog/understanding-kubernetes-kube-proxy/" rel="nofollow noreferrer">Understanding Kubernetes Kube-Proxy</a> </li>
</ul>

<p>Hope this helped</p>
