Services & Ingress, from the inside

The exposure ladder, and the production front door, this time opened up to show what each rung is actually made of.

Before you start. Kubernetes runs your program as many copies spread over many machines. One running copy is called a pod. Pods die and get replaced all the time, and each replacement arrives with a new address. Getting Traffic In (Services & Ingress) walks the path a request takes from outside; this lesson opens up the middle of that path. If one connection carrying many requests is new, How the web outgrew the phone call in Networking shows it in one read.

The idea in 30 seconds

A Service is a name for a changing pool of pods. It is not a machine, and since 2016 it has not been a proxy either.
It is enforced as a rule written straight into every machine’s own operating system by kube-proxy, not by a program relaying bytes.
The address that rule rewrites, the ClusterIP, belongs to no interface and no process. It only means something to the rule.
The rule picks one pod per connection, once, and never revisits the choice - which is why a caller that holds a connection open talks to only one pod, forever.
The list of who is currently answering is a separate, faster-moving object, the EndpointSlice, and it is what actually changes the instant a pod dies.
Ingress is the one place in this whole path where a real program reads each request instead of a rule blindly rewriting it.

Read the story · Skip to the numbers