Kubernetes Network Communication Requirements

Kubernetes requires efficient network communication between pods across nodes without NAT translation. The key communication scenarios include:

• Intra-pod container communication via loopback
• Direct pod-to-pod communication without NAT
• Pod-to-service communication through IPVS/iptables
• External client access via Ingress or NodePort services

Network Plugin Architecture

Kubernetes relies on CNI (Container Network Interface) plugins to implement networking. Popular options include:

1. Flannel: Simple to deploy but lacks network policies
2. Calico: Supports network policies and BGP routing
3. Canal: Combination of Flannel and Calico
4. Kube-router: Kubernetes-native solution

Flannel Backend Options

Flannel supports multiple backend communication mechanisms:

1. VXLAN (default): Encapsulates packets in VXLAN headers
2. host-gw: Uses host as gateway with direct routing
3. UDP: Legacy method with poor performance
4. DirectRouting: Hybrid approach using host-gw when possible

Configuring Flannel

Flannel configuration is stored in a ConfigMap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-flannel-cfg
  namespace: kube-system
data:
  net-conf.json: |
    {
      "Network": "10.244.0.0/16",
      "Backend": {
        "Type": "vxlan",
        "DirectRouting": true
      }
    }

Key configuration parameters:

• Network: CIDR range for pod IPs
• subnetLen: Subnet mask length for node allocation
• SubnetMin/Max: Range of allocatable subnets
• Backend: Communication mechanism

Implementing DirectRouting

To enable DirectRouting (host-gw when possible, VXLAN otherwise):

1. Edit the flannel ConfigMap:

kubectl edit configmap kube-flannel-cfg -n kube-system

2. Add "DirectRouting": true to the Backend section
3. Restart flannel pods:

kubectl delete pod -n kube-system -l app=flannel

Verification

After configuration, verify routing:

ip route

Test pod-to-pod communication and capture traffic:

kubectl exec -it <pod> -- ping <target-pod-ip>
tcpdump -i <interface> -nn icmp

Host-GW Configuration

For pure host-gw mode (nodes must be in same L2 network):

Backend:
  "Type": "host-gw"