Kubernetes Service Networking Explained: kube-proxy, iptables, IPVS, and eBPF

A detailed technical guide explores how Kubernetes routes traffic from a Service's virtual ClusterIP to actual backend Pods, a process known as the Service dataplane. The component historically responsible for this is kube-proxy, which runs on every node and watches Services and EndpointSlices to program the node's networking rules. Traditional clusters relied on iptables and DNAT to redirect packets, but this approach faces scaling limitations at large numbers of endpoints. IPVS was introduced as a more scalable alternative, while modern tools like Cilium use eBPF to bypass kube-proxy entirely for greater performance and flexibility. The guide also covers related concepts including SNAT, session affinity, CNI separation, and practical troubleshooting strategies for production Kubernetes environments.