1.17 Kubernetes Networking Definition

Kubernetes Networking Definition is the precise characterization of the foundational networking model Kubernetes requires of any cluster, defined not as a specific implementation but as a set of connectivity guarantees, chiefly that every Pod receives its own IP address and can reach every other Pod without network address translation, that any conforming network implementation must satisfy.

Defined as a Model, Not an Implementation

A Contract Any Network Plugin Must Fulfill

Kubernetes networking is defined at the level of required behavior rather than required technology: it specifies the guarantees a network must provide, such as flat, NAT-free Pod-to-Pod connectivity, while remaining agnostic to whether those guarantees are achieved through an overlay network, direct routing, or some other underlying mechanism.

Delegated to the Container Network Interface

The actual fulfillment of this model is delegated to a Container Network Interface (CNI) plugin; Kubernetes itself is defined as the consumer of this contract, not its implementer, meaning the specific mechanics of how Pod IPs are assigned and routed fall outside Kubernetes's own codebase.

The Core Guarantees

Every Pod Gets Its Own IP

Central to the definition is the requirement that every Pod be assigned a unique IP address, shared by all containers within that Pod, distinguishing Pod-level addressing from the older model of exposing individual container ports on a shared host IP.

No NAT Between Pods

The model further requires that Pods communicate with one another using their assigned IPs directly, without network address translation altering those addresses in transit, a guarantee that allows a Pod to see the same IP address for its peer that the peer sees for itself.

Node-to-Pod Reachability

The model additionally requires that nodes be able to reach every Pod in the cluster, which is necessary for functions such as the kubelet performing health checks against containers running on other nodes.

What the Definition Leaves Unspecified

Not a Statement About Performance or Topology

The Kubernetes networking definition makes no claims about the performance characteristics, encapsulation method, or physical topology used to satisfy its guarantees; two clusters using entirely different CNI plugins can both be fully compliant despite very different underlying network architectures.

Not Inclusive of Access Control

The base networking model defines connectivity guarantees only; it does not itself define or require any restriction on which Pods may communicate with which others. That additional layer of access control is defined separately, through NetworkPolicy objects layered on top of the base model.

Networking Model Boundary Diagram