Networking issues in Kubernetes

Traffic flow — memorise this picture

Client
   │
   v
+--------+     +----------+     +-------+
|Ingress | --> | Service  | --> |  Pod  |
+--------+     +----------+     +-------+
                                 │
                                 └── CNI network (Calico / Cilium / Flannel)
                                     provides pod-to-pod IP

If a request fails, find where along that chain it dies.

1. Service unreachable — ClusterIP port wrong

kubectl describe svc <svc>
kubectl get endpoints <svc>       # empty? → selector doesn't match pods

Fix the selector: labels to match the pod labels exactly.

2. NodePort not accessible

Cloud provider firewall closes the NodePort range (30000-32767). Open it in the security group / firewall.

3. LoadBalancer stuck in <pending>

Managed cluster couldn't provision a cloud LB. Check the cloud-controller-manager logs. Bare-metal clusters need MetalLB or similar.

4. DNS resolution fails inside pods

kubectl -n kube-system get pods    # CoreDNS running?
kubectl exec -it <pod> -- nslookup kubernetes.default

If CoreDNS is CrashLooping, cluster DNS is dead — fix CoreDNS first.

5. kube-dns service missing

The DNS service itself doesn't exist. Reinstall CoreDNS via addon manager or kubeadm.

6. Ingress not routing

kubectl describe ingress <ing>          # any events?
kubectl logs -n <ns> <ingress-ctlr-pod> # nginx/traefik errors

Checklist:

• Ingress class matches the controller (ingressClassName: nginx)?
• The referenced Service actually exists?
• TLS secret exists in the same namespace?

7. Ingress path matches nothing

nginx-ingress requires pathType: Prefix or Exact. If missing, some paths silently 404.

8. Ingress controller misconfigured

spec.rules is set but the controller doesn't see it → check RBAC (does the controller have list/watch on Ingress resources)?

9. NetworkPolicy blocks all traffic

Your CNI supports policies and you dropped a default-deny. Now nothing talks to anything.

# default-deny-ingress + allow-from-same-namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: allow-same-ns }
spec:
  podSelector: {}
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector: {}

10. NetworkPolicy not enforced

Your CNI doesn't support policies (some Flannel setups). Switch to Calico / Cilium.

11. CNI plugin issues → pods stuck without IP

kubectl -n kube-system get pods       # calico/cilium healthy?
crictl ps                             # check kubelet + runtime

Also check /etc/cni/net.d/ on the node.

12. Kube-proxy crashing → service IPs unreachable

kubectl -n kube-system logs -l k8s-app=kube-proxy

13. Pod-to-pod connectivity across nodes broken

Almost always a CNI or overlay-network issue. Check node routes, MTU, and node-to-node UDP/4789 (VXLAN).

14. External IP not assigned (LoadBalancer service)

Cloud quota exhausted or missing cloud-provider config. kubectl describe svc shows the reason.

15. Node network connectivity broken (kubelet ↔ API)

• Check systemctl status kubelet.
• nc -zv <control-plane-ip> 6443 from the node.
• Firewall rules between the node's subnet and the control plane.

Flow diagram — where is my request dying?

curl svc-ip     works? → ok
   │ no
   v
curl pod-ip     works? → service selector wrong
   │ no
   v
kubectl exec pod ping other-pod → CNI issue
   │
   v
DNS resolves?   nslookup svc.ns.svc.cluster.local → CoreDNS issue

Real-world example

Node A can reach checkout pods, node B can't. kubectl -n kube-system get pods -o wide shows Calico pod missing on node B. systemctl restart kubelet on node B fixes it — CNI plugin didn't recover after a kernel upgrade.