While L4 Kubernetes Services handle IP and port-level load balancing, modern web applications require Layer 7 HTTP/HTTPS routing features: URL path matching (/api vs /app), hostname routing (api.example.com), SSL/TLS termination, and header rewriting. This is handled by Ingress.
Pods are ephemeral—they are created, destroyed, and rescheduled dynamically, causing their IP addresses to change constantly. A Kubernetes Service provides a stable, persistent virtual IP (VIP), DNS name, and load balancing frontend across a dynamic set of backend Pods.
How do two containers on the same host talk to each other without exposing ports to the public internet? Docker uses Linux virtual network interfaces (veth pairs) connected to a software bridge.
Services provide stable IP addresses for ephemeral Pods, Ingress controllers route HTTP/S domain traffic at Layer 7, and NetworkPolicies act as Pod-level firewalls. In this episode, we build production manifests for all three.
