<p>I deployed a service <code>myservice</code> to the k8s cluster. Using <code>kubectl describe serivce ...</code>, I can find that the service ip is <code>172.20.127.114</code> . At the same time, the service endpoint is <code>10.34.188.30:5000,10.34.89.157:5000</code>. How does Kubernetes handle service address to endpoint address translation? Does <code>kube-proxy</code> handle the NAT?  Which linux module does <code>kube-proxy</code> use to handle NAT?</p>
<pre><code>kubectl describe service myservice                                     

Name:              myservice
Namespace:         default
Labels:            app=myservice
                   app.kubernetes.io/instance=myservice
Annotations:       argocd.argoproj.io/sync-wave: 3
Selector:          app=myservice
Type:              ClusterIP
IP Family Policy:  SingleStack
IP Families:       IPv4
IP:                172.20.127.114
IPs:               172.20.127.114
Port:              &lt;unset&gt;  80/TCP
TargetPort:        5000/TCP
Endpoints:         10.34.188.30:5000,10.34.89.157:5000
Session Affinity:  None
Events:            &lt;none&gt;
</code></pre>
<p><code>iptables</code> is used for setting node firewall rules. My understanding is that <code>iptables</code> does not do NAT.</p>

yuyang
<p>I hope this helps you.</p>
<h4>Pod to Pod communication</h4>
<ul>
<li>No built-in solution</li>
<li>Expects you to implement a networking solution</li>
<li>But impose fundamental requirements on any implementation to be pluggable
into Kubernetes</li>
</ul>
<h5>K8s requirements of CNI Plugins</h5>
<ul>
<li>Every Pod gets its unique IP address</li>
<li>Pods on the same Node can Communicate with that IP address</li>
<li>Pods on different Node can Communicate with that IP address <strong>without NAT</strong>
(Network Address Translation)</li>
</ul>
<hr />
<h4>Kubernetes Networking Model</h4>
<ul>
<li>All nodes must be able to reach each other, <strong>without NAT</strong></li>
<li>All pods must be able to reach each other, <strong>without NAT</strong></li>
<li>Pods and nodes must be able to reach each other, <strong>without NAT</strong></li>
<li>Each pod is aware of its IP address (<strong>no NAT</strong>)</li>
<li>Pod IP addresses are assigned by the network implementation</li>
</ul>
<hr />
<h4>Summary</h4>
<ul>
<li>The &quot;pod-to-pod network&quot; or &quot;pod network&quot;:
<ul>
<li>Provides communication between pods and nodes</li>
<li>Is generally implemented with CNI plugins</li>
</ul>
</li>
<li>The &quot;pod-to-service network&quot;:
<ul>
<li>Provides internal communication and load balancing</li>
<li>Is generally implemented with <code>kube-proxy</code></li>
</ul>
</li>
<li>Network policies:
<ul>
<li>Provide firewalling and isolation</li>
<li>Can be bundled with the &quot;pod network&quot; or provided by another component</li>
</ul>
</li>
<li>Inbound traffic can be handled by multiple components:
<ul>
<li>Something like kube-proxy (for NodePort services)</li>
<li>Load balancers (ideally, connected to the pod network)</li>
</ul>
</li>
<li>It is possible to use multiple pod networks in parallel (with &quot;meta-plugins&quot; like CNI-Genie or Multus)</li>
</ul>
<hr />
<h4>Useful Links</h4>
<ul>
<li><a href="https://github.com/alifiroozi80/CKA/tree/main/CKA#how-cni-plugins-implement-it" rel="nofollow noreferrer">How CNI works?</a></li>
<li><a href="https://github.com/alifiroozi80/CKA/tree/main/CKA#dns-in-kubernetes" rel="nofollow noreferrer">DNS in Kubernetes</a></li>
<li><a href="https://github.com/alifiroozi80/CKA/tree/main/CKA#how-requests-are-forwarded-from-service-to-pod" rel="nofollow noreferrer">How requests are forwarded from Service to Pod
</a></li>
</ul>
