Hands-on Lab·Certified Kubernetes Administrator
Service Traffic Policies and Source IP
One Pod on one node, reached through every node's NodePort. Flipping externalTrafficPolicy changes both what the backend sees and which nodes answer, and internalTrafficPolicy does the same thing to traffic that never leaves the cluster.
Services and Networking Guide 52 of 103 Advanced
- Kubernetes1.36.4
- Cluster4 nodes
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 17 min
Node addresses are this lab's. What matters is which address the backend reports, not its value.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker - hosts the only backend Pod | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker - no backend Pod, used to prove the difference | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when the client's real address has to survive the trip to your Pod, or when a NodePort should only answer on nodes actually running a backend. This matters because the default policy hides the source behind SNAT, and one field changes that at the cost of even distribution.
- pinning a single backend to a node you know, behind a NodePort
- asking who the backend thinks is calling, through the node with the Pod and a node without
- switching to
externalTrafficPolicy: Localand asking the same question again - applying the same idea to traffic that never leaves the cluster with
internalTrafficPolicy: Local
Before you start
- guide 47 - what a NodePort is before this changes how it behaves.
- guide 53 - the component that implements both policies.
-
One backend, pinned to a node you know
-
Who the backend thinks is calling
-
Switch the policy and ask again
-
The same idea for traffic that never leaves the cluster