Networking

A veth pair consists of two interconnected virtual Ethernet devices. A frame transmitted through one is delivered to the other, where the receiving network stack or bridge handles it. The two ends can reside in separate Linux network namespaces, making the pair useful for container networking. Creating the pair supplies a link; addresses, routes, bridge membership, forwarding, and access policy are additional configuration. ...

VXLAN carries an Ethernet frame inside a UDP packet so an overlay network can cross an IP underlay. Tunnel endpoints encapsulate and decapsulate frames, while a 24-bit VXLAN Network Identifier, or VNI, identifies the virtual segment. The outer IP addresses route between endpoints; the inner Ethernet and IP addresses serve the overlay. These are separate layers with separate reachability and configuration requirements. ...

A Service separates a stable discovery interface from replaceable backends. The before/after sets are model results, not a transport test. Stable discovery does not prove every request succeeds. Endpoint conditions, ports and datapaths need separate checks. The exact local model passed again; no Kubernetes or transport test was run. One address in front of many An ordinary ClusterIP Service keeps a virtual address during that object’s lifetime, and cluster DNS provides a discovery name. Callers can depend on that name while interchangeable Pods are replaced. This separates a stable client-facing contract from the lifecycle of individual backends, without requiring a config push for every replacement. ...

A timeout names how long a particular operation may wait. It is not automatically a deadline for the whole request, and it does not prove that the remote operation stopped. Separate connection establishment, individual reads, and the caller’s overall budget before choosing numbers or interpreting a timeout error. ...

A CNAME record associates an alias name with another DNS name. When resolving an address through that alias, a resolver follows the target until it obtains the requested data or encounters a failure. This lets a public hostname remain stable while its DNS dependency changes. It does not redirect a browser to another URL or replace the application’s requested hostname. ...

Several A or AAAA records at one name provide an address set. A DNS server may rotate the order it returns, but the receiving resolver and application decide how to use that set. Ordinary address records contain no request-load measurement or application-health result. Their presence alone does not promise equal traffic, automatic failover, or even a particular first address across implementations. ...

A NodePort Service allocates a cluster-wide port and arranges forwarding through eligible node addresses. It is useful for external load balancers, development environments and deliberately exposed services. It does not make every address on every machine reachable, nor does it promise an application-level listening socket on each node. Network routing, firewalls, proxy implementation and traffic policy remain part of the path. ...

An idle timeout closes a connection after a defined period without qualifying activity. It is a resource policy, not proof that the client disappeared. Quiet connections can belong to healthy clients; the useful question is which activity resets which timer, and what the protocol allows after closure. ...