Networking

A veth pair consists of two interconnected virtual Ethernet devices. A frame transmitted through one is delivered to the other, where the receiving network stack or bridge handles it. The two ends can reside in separate Linux network namespaces, making the pair useful for container networking. Creating the pair supplies a link; addresses, routes, bridge membership, forwarding, and access policy are additional configuration. ...

VXLAN carries an Ethernet frame inside a UDP packet so an overlay network can cross an IP underlay. Tunnel endpoints encapsulate and decapsulate frames, while a 24-bit VXLAN Network Identifier, or VNI, identifies the virtual segment. The outer IP addresses route between endpoints; the inner Ethernet and IP addresses serve the overlay. These are separate layers with separate reachability and configuration requirements. ...

You cannot memorise a Pod that will be recreated. A Service fixes an address in front of them, keeping callers stable while pods churn. One address in front of many A Deployment gives you multiple, interchangeable pods, and each one has its own IP that will soon be recreated. A Service is the stable home in front of them: you declare a name and a selector, and the platform hands the Service a virtual cluster IP plus a DNS name that stay fixed. Cluster DNS resolves that name, so components (other pods, an Ingress, a load balancer) refer to the Service, never to an individual pod address. That is the point of the abstraction, the address is durable even though everything standing behind it is disposable. ...

A timeout names how long a particular operation may wait. It is not automatically a deadline for the whole request, and it does not prove that the remote operation stopped. Separate connection establishment, individual reads, and the caller’s overall budget before choosing numbers or interpreting a timeout error. ...

A CNAME record associates an alias name with another DNS name. When resolving an address through that alias, a resolver follows the target until it obtains the requested data or encounters a failure. This lets a public hostname remain stable while its DNS dependency changes. It does not redirect a browser to another URL or replace the application’s requested hostname. ...

Several A or AAAA records at one name provide an address set. A DNS server may rotate the order it returns, but the receiving resolver and application decide how to use that set. Ordinary address records contain no request-load measurement or application-health result. Their presence alone does not promise equal traffic, automatic failover, or even a particular first address across implementations. ...

A Service of type NodePort does one blunt thing: it reserves a port in the 30000-32767 range and makes every node in the cluster listen on it. kube-proxy programs the same forwarding rule into the iptables or IPVS tables of every machine, so curl <any-node-ip>:<nodePort> reaches the Service no matter which node answers. That is the whole appeal — external reachability with no cloud load balancer, no DNS record and no ingress controller. ...

An idle timeout closes a connection after a defined period without qualifying activity. It is a resource policy, not proof that the client disappeared. Quiet connections can belong to healthy clients; the useful question is which activity resets which timer, and what the protocol allows after closure. ...