What is POD?
A point of delivery, or PoD, is “a module of network, compute, storage, and application components that work together to deliver networking services.
An overlay network is a computer network that is built on top of another network.
An overlay is a virtual network that is built on top of underlying network infrastructure.
The purpose is to implement a network service that is not available in the physical network.
A pod network in Kubernetes is an example of an overlay network that takes individual private networks within each node and transforms them into a new software-defined network (SDN) with a shared namespace, which allows pods to communicate across nodes.
There are Different type of pod network
https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#pod-network
- calico
- canal
- cilium
- flannel
- kube-router
- romana
- weave net
- juniper
- contiv-VPP
calico: https://docs.projectcalico.org/v3.5/getting-started/
flannel: https://github.com/coreos/flannel
weave: https://www.weave.works/docs/net/latest/kubernetes/kube-addon/
OpenShift SDN provides three SDN plug-ins for configuring the pod network:
- The ovs-subnet plug-in is the original plug-in which provides a “flat” pod network where every pod can communicate with every other pod and service.
- The ovs-multitenant plug-in provides OpenShift Container Platform project level isolation for pods and services. Each project receives a unique Virtual Network ID (VNID) that identifies traffic from pods assigned to the project. Pods from different projects cannot send packets to or receive packets from pods and services of a different project.
However, projects which receive VNID 0 are more privileged in that they are allowed to communicate with all other pods, and all other pods can communicate with them. In OpenShift Container Platform clusters, the default project has VNID 0. This facilitates certain services like the load balancer, etc. to communicate with all other pods in the cluster and vice versa.
- The ovs-networkpolicy plug-in (currently in Tech Preview) allows project administrators to configure their own isolation policies using NetworkPolicy objects.
$ oc get netpol -n default
NAME POD-SELECTOR AGE
allow-everything 262d
allow-from-global-namespaces 183d
allow-from-same-namespace 183d
$ oc get netpol -n kube-system
NAME POD-SELECTOR AGE
allow-from-global-namespaces 183d
allow-from-same-namespace 183d
linuxmadeeasy 