Hands-on Lab·Certified Kubernetes Administrator
Service Traffic Policies and Source IP
One Pod on one node, reached through every node's NodePort. Flipping externalTrafficPolicy changes both what the backend sees and which nodes answer, and internalTrafficPolicy does the same thing to traffic that never leaves the cluster.
Services and Networking Guide 52 of 103 Advanced
- Kubernetes1.36.4
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 17 min
- Reviewed26 August 2026
Written against the versions above. Node addresses are this lab's. What matters is which address the backend reports, not its value.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker - hosts the only backend Pod | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker - no backend Pod, used to prove the difference | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- guide 47 - what a NodePort is before this changes how it behaves.
- guide 53 - the component that implements both policies.
-
One backend, pinned to a node you know
-
Who the backend thinks is calling
-
Switch the policy and ask again
-
The same idea for traffic that never leaves the cluster