> For the complete documentation index, see [llms.txt](https://memogarcia.gitbook.io/continuous-learning/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://memogarcia.gitbook.io/continuous-learning/tech/kubernetes/kubernetes-deep-dive.md).

# Kubernetes deep dive

## Network

Kubernetes creates a network namespace for each pod.

Ip forwarding

```bash
sudo sysctl --write net.ipv4.ip_forward=1
```

CNI

```bash
ip a

6: cni0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP group default qlen 1000
    link/ether 4a:2f:b7:2b:28:07 brd ff:ff:ff:ff:ff:ff
    inet 10.42.0.1/24 brd 10.42.0.255 scope global cni0
       valid_lft forever preferred_lft forever
    inet6 fe80::482f:b7ff:fe2b:2807/64 scope link
       valid_lft forever preferred_lft forever
```

When a service is created...

```bash
╭─memo at elitebook in ~ 22-11-09 - 22:39:20
╰─○ sudo iptables -L | grep yelb-appserver
NFLOG      all  --  anywhere             anywhere             /* rule to log dropped traffic POD name:yelb-appserver-5d89946ffd-lqs9q namespace: yelb */ mark match ! 0x10000/0x10000 limit: avg 10/min burst 10 nflog-group 100
REJECT     all  --  anywhere             anywhere             /* rule to REJECT traffic destined for POD name:yelb-appserver-5d89946ffd-lqs9q namespace: yelb */ mark match ! 0x10000/0x10000 reject-with icmp-port-unreachable
```

What is this? and where is the IP of the svc? on iptables?

```bash
ip a

veth2a30daaa@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master cni0 state UP group default
    link/ether 92:43:c9:f8:e6:92 brd ff:ff:ff:ff:ff:ff link-netns cni-483209c9-dd60-93df-0448-a08be95aa6f6
    inet6 fe80::9043:c9ff:fef8:e692/64 scope link
       valid_lft forever preferred_lft forever
```

## References

* <https://cloud.redhat.com/blog/kubernetes-namespaces-demystified-how-to-make-the-most-of-them>