Pod-to-Pod Networking
notes-web must talk to notes-db. They may run on different nodes, in different racks. Before learning Services, you need the simple promise that Kubernetes makes about how pods reach each other.
The rule
Every pod gets its own IP, and every pod can reach every other pod directly.
The Kubernetes network model has a few firm rules:
- Each pod gets its own IP address, shared by all its containers.
- Any pod can reach any other pod by its IP, on any node, without NAT (the address the receiver sees is the sender's real pod IP).
- Agents on a node, such as the kubelet, can reach all pods on that node.
- Containers inside one pod talk over
localhost.
Kubernetes itself does not build this network. A CNI plugin (Container Network Interface) does — for example Calico, Cilium or Flannel. Managed clusters install one for you.
kubectl get pods -n notes -o wide
# NAME READY STATUS IP NODE
# notes-web-a 1/1 Running 10.244.1.7 node-1
# notes-db-0 1/1 Running 10.244.2.4 node-2From inside notes-web-a, a connection to 10.244.2.4:5432 reaches Postgres on another node directly.
By default the network is open: every pod may reach every pod. A NetworkPolicy can restrict that — for example "only pods labelled app: notes-web may connect to notes-db on port 5432" — provided the CNI plugin supports policies.
The shortcut
Picture the cluster as one flat office floor: every desk (pod) has a phone number (IP) and can call any other desk directly. The catch: desks move, and numbers change.
It works
notes-web connects to
10.244.2.4:5432and reaches the database on node-2.
The trap is copying a pod IP into configuration. It works on the day you test it and breaks the next time the pod is replaced.
Drills
Answer fast — trust the rule.
Two containers in the same pod need to talk. What address do they use?
Which component actually builds the pod network?
With no NetworkPolicy, can a pod in namespace notes reach a pod in another namespace by IP?
Why is hard-coding notes-db's pod IP in notes-web's settings a mistake?
Remember
- Every pod gets its own IP and can reach every other pod directly, without NAT.
- One flat office floor — but desks move and numbers change.
- Trap: hard-coding pod IPs; namespaces alone do not isolate traffic.