How Traffic Flows in Kubernetes

Hi Inner Circle,

Today we’re going back to networking fundamentals.

Because before you can debug a production outage, scale a service, or confidently discuss service meshes in an interview, you need to understand how traffic actually moves through a Kubernetes cluster.

This isn’t just another diagram to memorize.

Almost every Kubernetes networking question eventually comes back to two core concepts:

North-South traffic and East-West traffic.

Before we begin... a big thank you to today's sponsor MONTE CARLO

10x agent growth. Zero room for blind trust. Is your AI stack ready?

Join Barr Moses, Co-Founder & CEO of Monte Carlo, and Iwao Fusillo, Chief Data & Analytics Officer of the New York Jets, for a candid conversation on running AI agents in one of the most unforgiving environments in pro sports — where there's no hiding from a bad output.

You will learn:

What infrastructure teams need to know before AI agents grow 10X.

What agent trust looks like inside a high-stakes, real-time environment, and how the Jets hold AI accountable.

How Monte Carlo's AI-powered autonomous observability system helps data + AI teams scale monitoring without adding headcount.

JULY 23, 2026 · 10 AM PDT / 1 PM EDT

Why Understanding Traffic Flow Matters

- It shows how requests reach your app: traffic may pass through a Load Balancer, Gateway/Ingress, Service, kube-proxy, CNI, and finally a Pod.

- It helps define security boundaries: internet traffic and internal service traffic need different security controls.

- It helps during incidents: when an app is unreachable, first ask: is it a north-south issue or an east-west issue?

In this breakdown, we’ll cover:

• what north-south and east-west traffic mean

• which Kubernetes components are involved

• how networking connects everything

• why this matters in real production systems

North-South Traffic: also called as “The Front Door”

What it is:

North-south traffic is traffic entering or leaving the cluster, such as an internet client calling an application running in Kubernetes.

Traffic usually enters through a cloud LoadBalancer, then an Ingress Controller or Gateway API, where TLS termination and L7 routing can happen before the request reaches an internal Service and Pod.

When it matters:

Any time external users, mobile apps, SaaS systems, or third-party APIs need to reach something inside your cluster.

Key components:

- LoadBalancer: exposes traffic externally, usually through a cloud provider load balancer.

- Ingress Controller / Gateway API: handles host-based, path-based, and protocol-aware routing.

- TLS / L7 Routing: terminates HTTPS and makes application-level routing decisions before traffic reaches the backend Pods.

East-West Traffic: Inter-Service Communication

What it is:

East-west traffic is internal traffic between workloads inside the cluster, such as a payments service calling an inventory service, or one Pod communicating with another Pod.

In microservices architectures, this is often the majority of total traffic.

When it matters:

It matters whenever your application depends on service-to-service communication, which is common in most real production systems.

Key components:

- Pod-to-Pod communication: Pods get routable IPs and can communicate directly across the cluster.

- Service Discovery / CoreDNS: services find each other by DNS name instead of hardcoded IPs.

- Service Mesh: adds observability, retries, mTLS, and traffic shaping between services.

Network Policies: control which Pods can communicate with each other, usually by labels, namespaces, IP blocks, and ports.

The Shared Components

Both North-South and East-West traffic eventually pass through the same core Kubernetes networking layers, regardless of where the request originated:

- Service (ClusterIP / NodePort / LoadBalancer): stable front door for changing Pods.

- kube-proxy: routes Service traffic to the right Pod via iptables/IPVS.

- Pod IP: final destination after routing.

- CNI: provides Pod networking, NetworkPolicy, and often encryption.

Underneath all of that sits the Node Network ~ the physical node - which is a topic for another time.. as it’s too much for you to consume!

Key Points To Remember For Infra Design And Interviews

Microservices mostly use east-west traffic: one user request can trigger many internal service-to-service calls.

Service mesh helps manage east-west traffic: it adds observability, security, retries, mTLS, and traffic control between services.

Zero trust limits internal access: Network Policies restrict which Pods can talk to each other, so one compromised Pod cannot reach everything.

API Gateway / Gateway API handles north-south traffic: it manages traffic entering the cluster, especially for REST, gRPC, and WebSockets.

CoreDNS enables service discovery: services use stable DNS names instead of hardcoded IPs, so Pods can scale, move, or restart safely.

I hope this cleared up a topic that trips up a lot of engineers moving from single-node deployments to real, multi-service clusters.

If you want to dive deeper, check out these videos

See you in the next one!

-V