Kubernetes Networking

Kubernetes networking rests on one rule: every pod gets its own IP and can reach every other pod without NAT. Everything above that — Services, Ingress, NetworkPolicy — exists because pod IPs are not stable and not exposed. Services give you a stable virtual IP and load balancing. Ingress puts an HTTP router in front of Services so many hostnames share one entry point. NetworkPolicy takes the default-allow flat network and narrows it down. Get those three roles clear and the failure modes stop being mysterious.