Stage 7 · Master
CKA — Certified Kubernetes Administrator
Services & Networking (20%)
CNI, Services, Ingress, NetworkPolicy, and CoreDNS — connecting workloads.
Service Types
Services provide stable networking for Pods. They load-balance traffic across healthy Pod replicas. There are four Service types, each with different use cases and exposure levels.
| Type | Exposure | Use Case |
|---|---|---|
| ClusterIP | Internal cluster only | Default, internal service communication |
| NodePort | Static port on each node | Development, external access without LB |
| LoadBalancer | Cloud provider load balancer | Production external access |
| ExternalName | CNAME to external service | Reference external services |
# Create a ClusterIP service
kubectl expose deployment nginx --port=80 --type=ClusterIP
# Create a NodePort service
kubectl expose deployment nginx --port=80 --type=NodePort --node-port=30080
# Create a LoadBalancer service
kubectl expose deployment nginx --port=80 --type=LoadBalancerThe --port flag is the port the Service listens on. The --node-port flag is the static port on each node (for NodePort type). The target port defaults to the container port.
Ingress Controllers
Ingress exposes HTTP and HTTPS routes from outside the cluster to Services within the cluster. It handles hostname-based and path-based routing, TLS termination, and load balancing.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
ingressClassName: nginx
tls:
- hosts:
- app.example.com
secretName: tls-secret
rules:
- host: app.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: my-service
port:
number: 80The ingressClassName field specifies which Ingress controller to use. Without an Ingress controller, Ingress resources have no effect. Common controllers include nginx, traefik, and HAProxy.
Network Policies
Network Policies are Kubernetes-native firewall rules for Pods. They control ingress and egress traffic at the Pod level. Without Network Policies, all Pods can communicate with all other Pods by default.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-web-frontend
namespace: production
spec:
podSelector:
matchLabels:
app: backend
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080This NetworkPolicy allows ingress traffic to Pods labeled app=backend only from Pods labeled app=frontend on port 8080. All other ingress traffic is denied.
Multiple Network Policies that select the same Pod are combined. There is no way to deny specific traffic while allowing others — you can only add allow rules. Start with a deny-all policy and add specific allows.
CoreDNS
CoreDNS is the cluster DNS server. It resolves Service names to cluster IPs and provides DNS-based service discovery. Every Pod uses CoreDNS for name resolution by default.
# Test DNS resolution from inside a Pod
kubectl exec -it my-pod -- nslookup kubernetes.default
kubectl exec -it my-pod -- nslookup my-service.my-namespace.svc.cluster.local
# Check CoreDNS pods
kubectl get pods -n kube-system -l k8s-app=kube-dns
# Check DNS config
kubectl exec -it my-pod -- cat /etc/resolv.confDNS names follow the pattern: service-name.namespace.svc.cluster.local. If DNS resolution fails, check CoreDNS pods and the /etc/resolv.conf in the failing Pod.
CNI Plugins
The Container Network Interface (CNI) defines how networking is configured for containers. CNI plugins handle IP allocation, routing, and network policy enforcement.
| Plugin | Features | Best For |
|---|---|---|
| Calico | Network policies, BGP, VXLAN | Production, policy-heavy environments |
| Cilium | eBPF, advanced networking, observability | Performance and security critical |
| Flannel | Simple overlay networking | Development, small clusters |
| Weave Net | Encrypted overlay, simple setup | Small to medium clusters |
Service Mesh Overview
A service mesh adds a dedicated infrastructure layer for service-to-service communication. It handles traffic management, security, and observability without application changes.
- Istio — Full-featured mesh with Envoy sidecars.
- Linkerd — Lightweight, low-overhead mesh.
- Cilium — eBPF-based mesh without sidecars.
Key Commands
kubectl get svc -A
kubectl describe svc my-service
kubectl get endpoints my-service
kubectl get ingress -A
kubectl get networkpolicies -A
kubectl run test --image=busybox --rm -it -- nslookup my-service
kubectl get pods -n kube-system -l k8s-app=kube-dnsEndpoints show which Pods a Service is actually routing to. If a Service has no Endpoints, the Pods are either not running or do not match the selector.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.