Kubernetes Service

Service discovery is the process by which a client application or another service dynamically finds the network endpoint (IP and port) of a service it needs to communicate with. In Kubernetes, this is primarily handled via DNS. When a Service is created, it is automatically assigned a DNS name following the pattern <service-name>.<namespace>.svc.cluster.local. Pods can discover other services by querying this DNS name, which resolves to the Service's stable ClusterIP. This decouples clients from the ephemeral nature of individual Pod IPs.

• Client-Side Discovery: The client queries a registry (like the Kubernetes API or internal DNS) and selects an instance.
• Server-Side Discovery: A router or load balancer (like an Ingress controller) handles the discovery and routing on behalf of the client.

A service mesh is a dedicated infrastructure layer for managing service-to-service communication in a microservices architecture. It provides capabilities like service discovery, load balancing, failure recovery, metrics, and observability through a network of lightweight proxies deployed alongside each service instance (often as a sidecar). While a native Kubernetes Service provides basic discovery and load balancing, a service mesh like Istio or Linkerd offers advanced traffic management (canary deployments, circuit breaking), secure mTLS communication, and detailed telemetry without requiring changes to application code. The mesh's control plane typically integrates with the Kubernetes API to discover Services and Pods.

An Ingress is a Kubernetes API object that manages external HTTP/HTTPS access to Services within a cluster. It functions as a Layer 7 (application layer) load balancer and router. While a Service (of type ClusterIP or NodePort) exposes a way to reach Pods internally or on a node port, an Ingress provides external, domain-based routing rules. For example, an Ingress can route traffic to api.example.com to the backend-api Service and app.example.com to the frontend Service. An Ingress requires an Ingress Controller (like NGINX, Traefik, or an AWS ALB Controller) to be running in the cluster to implement the rules defined in the Ingress resource.

EndpointSlices are a scalable and extensible alternative to the legacy Endpoints object in Kubernetes. They track the network endpoints (Pod IPs) that back a Service. When a Service selector matches Pod labels, the control plane automatically creates EndpointSlices containing the IP addresses and ports of those Pods. The kube-proxy component on each node watches EndpointSlices to update iptables or IPVS rules, enabling traffic to be load-balanced to healthy Pods. EndpointSlices improve performance in large clusters by splitting endpoints across multiple slice objects and support additional attributes like topology hints for efficient routing.

A Headless Service is a Kubernetes Service created by setting clusterIP: None in its spec. Unlike a standard Service, it does not have a ClusterIP and does not perform load balancing or proxying. Instead, DNS queries for the headless Service return the set of Pod IPs that are endpoints for the Service. This allows clients to discover all Pod IPs directly and implement their own load-balancing logic or communicate with specific instances. Headless Services are commonly used for stateful applications (like databases) where each Pod has a unique identity, and for enabling peer discovery in frameworks like Apache Kafka or Elasticsearch clusters deployed via StatefulSets.

kube-proxy is a network proxy that runs on every node in a Kubernetes cluster. Its primary role is to implement the virtual IP networking of Services. It watches the Kubernetes API server for changes to Services and EndpointSlices. For each Service, kube-proxy configures routing rules (using iptables, IPVS, or userspace mode) to forward traffic sent to the Service's ClusterIP or NodePort to one of the healthy backend Pods. It is responsible for the core load-balancing functionality of Services. The choice of proxy mode (e.g., IPVS) can affect performance and feature support for complex load-balancing algorithms and large-scale services.