External User
     │
     ▼
[ LoadBalancer / Ingress ]
     │
     ▼
[ Service ]
     │
     ▼
[ Pod (via kube-proxy / iptables / eBPF) ]
     │
     ▼
[ Container ]

Internet → Cloud LB → NodePort (on any node) → Service → Pod

Internet → Cloud LB → Ingress Controller Pod → Service → Pod

# Example Ingress rule
spec:
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /api
            backend:
              service:
                name: api-service
                port:
                  number: 80
          - path: /web
            backend:
              service:
                name: web-service
                port:
                  number: 80

Pod A → Service ClusterIP → iptables/IPVS → Pod B (one of N replicas)

api                          # within same namespace
api.default                  # short form
api.default.svc.cluster.local  # fully qualified

Pod A (10.244.1.5) → Pod B (10.244.2.8)   # direct, no NAT

1. DNS resolves app.example.com → Cloud LB IP
2. Cloud LB receives request on port 443
   → forwards to Ingress Controller pod (e.g. nginx on port 443)
3. Ingress Controller terminates TLS
   → matches rule: host=app.example.com, path=/api
   → forwards to Service "api-service:80"
4. CoreDNS resolves "api-service" → ClusterIP (e.g. 10.96.45.12)
5. iptables on the node intercepts packet to 10.96.45.12
   → rewrites destination to a healthy pod IP (e.g. 10.244.2.7:8080)
   → load balances across replicas
6. Packet reaches Pod
   → container handles request on port 8080
7. Response travels back the same path in reverse

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow-only-frontend
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - port: 8080

Pod A → Envoy sidecar → mTLS encrypted tunnel → Envoy sidecar → Pod B