Networking and Services

Kubernetes networking is split between pod networking (handled by an external CNI plugin) and Service networking (handled by kube-proxy). The repository owns the Service abstraction, EndpointSlice computation, NetworkPolicy validation, and the kube-proxy data-plane backends. Pod-to-pod connectivity is the CNI plugin's job and lives in plugin repos like Calico, Cilium, and Flannel — not here.

What this repo contains

• Service / EndpointSlice / Endpoints API objects: types in staging/src/k8s.io/api/core/v1/types.go and staging/src/k8s.io/api/discovery/v1/types.go. Registry in pkg/registry/core/service/ and pkg/registry/discovery/.
• NetworkPolicy / Ingress / IngressClass API objects: staging/src/k8s.io/api/networking/v1/types.go. Registry in pkg/registry/networking/. Implementation is not in this repo — NetworkPolicy is enforced by a CNI plugin; Ingress by an Ingress controller.
• EndpointSlice controller: pkg/controller/endpointslice/. Watches Service and Pod, builds EndpointSlice resources.
• EndpointSlice mirroring controller: pkg/controller/endpointslicemirroring/. Mirrors externally managed Endpoints into EndpointSlice form.
• kube-proxy backends: pkg/proxy/{iptables,nftables,ipvs,winkernel}/. See components/kube-proxy.
• kubelet pod network plumbing: pkg/kubelet/network/ — kubelet's view of pod IP allocation and CNI status.
• ServiceCIDR controller: pkg/controller/servicecidrs/. Multi-CIDR Service VIP allocation (alpha).

Service types

Type	Behaviour	Implementation
ClusterIP	Stable in-cluster VIP	kube-proxy programs DNAT
NodePort	ClusterIP + a port on every node	kube-proxy + iptables/nftables/IPVS
LoadBalancer	NodePort + an external LB	Cloud-controller-manager creates the LB
ExternalName	DNS CNAME	Resolved by kube-dns / CoreDNS
Headless (clusterIP: None)	DNS A records, no proxying	kube-dns / CoreDNS

Services optionally carry topologyKeys / topologyAware hints, an internalTrafficPolicy (Cluster vs Local), an externalTrafficPolicy (Cluster vs Local), and dual-stack ipFamilies.

EndpointSlice

Endpoints was the original "set of pods backing a Service" object — but it grew to hundreds of KB for large Services and any single backing-pod change required rewriting the whole object. EndpointSlice replaces it with a sharded model: each slice holds at most 100 endpoints, slices are independent, and the same Service can have many slices.

The pkg/controller/endpointslice/ controller:

1. Watches Service and Pod.
2. For each selected Pod, decides which slice it belongs to (rebalancing if needed).
3. Issues Patch / Create / Delete on EndpointSlice objects.
4. Tracks per-slice fingerprints so spurious updates are skipped.

Topology hints are computed here, not in the proxy — the controller knows the Pod's zone and writes Endpoint.Hints.ForZones. Kube-proxy reads those hints and prefers same-zone endpoints when its zone-distribution thresholds are satisfied.

DNS

pkg/registry/core/service/portallocator/ and pkg/registry/core/service/ipallocator/ allocate cluster-wide unique Service VIPs and ports. DNS resolution is not in this repo — CoreDNS lives at kubernetes/dns and is installed as an addon.

NetworkPolicy

NetworkPolicy resources are validated and stored here, but enforcement lives in the CNI plugin. The validation logic in pkg/apis/networking/validation/validation.go ensures that ingress/egress rules, namespace selectors, and port specs are well-formed.

ServiceCIDR

The ServiceCIDR resource (alpha) lets cluster admins add additional CIDR ranges for Service VIPs without restarting the apiserver. The controller in pkg/controller/servicecidrs/ reconciles ServiceCIDR objects with the apiserver's IP allocator.

ClusterTrustBundle

ClusterTrustBundle is the platform-managed CA bundle distribution mechanism. The kubelet projects it into pods via the projected-volume clusterTrustBundle source. Code: pkg/kubelet/clustertrustbundle/, staging/src/k8s.io/api/certificates/v1beta1/types.go.

How a packet to a Service VIP flows

1. A Pod sends a packet to 10.96.42.42:80 (the Service ClusterIP).
2. The Linux kernel's netfilter (or nftables, or IPVS) matches the destination.
3. kube-proxy's rules DNAT the packet to one of the backing Pod IPs (chosen by hash + preference for same-zone if topology hints apply).
4. The packet leaves the node via the CNI plugin's pod network.
5. Conntrack records the connection so reply packets are reverse-translated.

For external traffic to a NodePort or LoadBalancer Service:

• externalTrafficPolicy: Cluster — kube-proxy may forward to any node-local or cluster-wide endpoint. Source IP is preserved only for Local policy.
• externalTrafficPolicy: Local — kube-proxy only forwards to local endpoints; preserves source IP. The Service's healthcheck endpoint (pkg/proxy/healthcheck/) tells the LB which nodes have local endpoints.

Key source files

File	Purpose
pkg/registry/core/service/storage/storage.go	Service REST registry
pkg/registry/discovery/endpointslice/storage/storage.go	EndpointSlice REST registry
pkg/controller/endpointslice/endpointslice_controller.go	EndpointSlice computation
pkg/controller/endpointslicemirroring/endpointslicemirroring_controller.go	Mirror Endpoints → EndpointSlice
pkg/proxy/topology.go	Topology-aware routing helper
pkg/registry/networking/networkpolicy/strategy.go	NetworkPolicy validation
staging/src/k8s.io/endpointslice/	Library used by both controller and proxy