Pod-to-Pod communication in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Pod-to-Pod Communication Using ClusterIP Service

You have two pods in the same Kubernetes namespace. Pod A tries to connect to Pod B using a ClusterIP service named service-b on port 8080. What will be the output of the following command run inside Pod A?

curl http://service-b:8080/health

A Connection refused error

B Timeout error after several seconds

C DNS resolution error: service-b not found

D HTTP 200 OK with health status message

💡 Hint

ClusterIP services provide stable internal IPs and DNS names for pods in the same namespace.

ClusterIP services allow pods within the same namespace to communicate using the service name. If Pod B is running and listening on port 8080, Pod A's curl command will succeed and return HTTP 200 OK with the health status.

🧠 Conceptual

intermediate

Understanding Pod-to-Pod Communication Across Namespaces

Which statement correctly describes how pods communicate across different namespaces in Kubernetes?

A Pods communicate across namespaces by using the full DNS name including the namespace.

B Pods cannot communicate across namespaces under any circumstances.

C Pods can communicate across namespaces only if a NetworkPolicy allows it.

D Pods communicate across namespaces using the service name without specifying the namespace.

💡 Hint

Think about how Kubernetes DNS resolves service names across namespaces.

To communicate with a pod or service in another namespace, you must use the full DNS name, which includes the service name and the namespace, like service-name.namespace.svc.cluster.local. NetworkPolicies can restrict traffic but do not enable communication by themselves.

❓ Troubleshoot

advanced

Troubleshooting Pod Communication Failure

Pod A cannot reach Pod B even though both are running and in the same namespace. The service for Pod B is a ClusterIP service. Which of the following is the most likely cause?

A Pod B is not listening on the port defined in the service.

B Pod A is using the external IP of Pod B instead of the service name.

C Pod A and Pod B are in different Kubernetes clusters.

D Pod B's container image is missing.

💡 Hint

Check if the service port matches the container port Pod B listens on.

If Pod B is not listening on the port defined in the service, the service will not forward traffic correctly, causing Pod A's connection attempts to fail. Using the service name is correct within the same namespace.

🔀 Workflow

advanced

Steps to Enable Pod-to-Pod Communication with NetworkPolicy

You want to restrict pod-to-pod communication in a namespace but allow Pod A to communicate with Pod B on port 80. Which sequence of steps correctly achieves this?

A 1,2,3,4

B 3,2,1,4

C 1,3,2,4

D 3,1,2,4

💡 Hint

Think about labeling pods before creating policies that select them.

First, create a default deny ingress policy. Then label pods so policies can select them. Next, create a policy allowing Pod A to access Pod B on port 80. Finally, apply the policies.

✅ Best Practice

expert

Best Practice for Secure Pod-to-Pod Communication

Which approach is the best practice to secure pod-to-pod communication in a Kubernetes cluster?

A Allow all traffic between pods and rely on pod security policies.

B Use NetworkPolicies to restrict traffic and enable mutual TLS between pods.

C Use host networking for all pods to simplify communication.

D Disable Kubernetes DNS to prevent pod name resolution.

💡 Hint

Consider both network restrictions and encryption.

Combining NetworkPolicies to restrict traffic with mutual TLS (mTLS) for encrypted communication is the best practice to secure pod-to-pod communication. Other options either reduce security or break Kubernetes networking.

Practice

1.

How do pods inside a Kubernetes cluster typically communicate with each other?

easy

A. Using external DNS names only

B. Using pod IP addresses or service names

C. Through direct access to the host machine's network

D. By sharing the same storage volume

Solution

1. Step 1: Understand pod networking basics

   Pods have their own IP addresses inside the cluster and can communicate directly using these IPs.

2. Step 2: Recognize the role of services

   Services provide stable DNS names to reach pods even if pod IPs change.

3. Final Answer:

   Using pod IP addresses or service names -> Option B

4. Quick Check:

   Pod communication = IP or service name [OK]

Hint: Pods use IPs or services to talk inside cluster [OK]

Common Mistakes:

• Thinking pods use external DNS only
• Assuming pods share host network by default
• Believing storage volumes enable communication

2.

Which of the following is the correct way to define a Kubernetes Service to expose pods for pod-to-pod communication?

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080

easy

A. The service exposes port 8080 externally but does not select pods

B. The selector matches pods with label app: myapp but ports are reversed

C. The selector matches pods with label app: myapp and forwards port 80 to 8080

D. The service definition is missing the type field, so it won't work

Solution

1. Step 1: Check the selector field

   The selector app: myapp correctly matches pods with that label.

2. Step 2: Verify ports mapping

   Port 80 on the service forwards traffic to port 8080 on the pods, which is correct.

3. Final Answer:

   The selector matches pods with label app: myapp and forwards port 80 to 8080 -> Option C

4. Quick Check:

   Selector and ports correct = The selector matches pods with label app: myapp and forwards port 80 to 8080 [OK]

Hint: Selector matches pod labels; ports map service to pod [OK]

Common Mistakes:

• Confusing port and targetPort roles
• Thinking 'type' is mandatory for basic service
• Ignoring selector means no pods matched

3.

Given two pods in the same namespace, pod-a and pod-b, where pod-b runs a web server on port 80, what is the expected output of this command run inside pod-a?

curl http://pod-b:80

Assuming pod-b is reachable by its pod IP but not by name.

medium

A. Connection refused or host not found error

B. Successful HTTP response from pod-b's web server

C. Timeout error because pods cannot communicate

D. DNS resolution error for pod-b

Solution

1. Step 1: Understand pod DNS naming

   Pods do not have DNS names by default; only services have stable DNS names.

2. Step 2: Analyze the command

   Trying to curl pod-b by name will fail DNS resolution because pod names are not DNS entries.

3. Final Answer:

   DNS resolution error for pod-b -> Option D

4. Quick Check:

   Pod names not DNS = DNS resolution error [OK]

Hint: Pod names are not DNS names; use service names [OK]

Common Mistakes:

• Assuming pod names resolve in DNS
• Expecting direct pod name communication
• Ignoring need for service abstraction

4.

You have a service named backend exposing pods on port 8080. A pod tries to connect using curl http://backend:80 but gets a connection refused error. What is the likely cause?

medium

A. The service port is 8080, but curl uses port 80

B. The service selector does not match any pods

C. The pod network is not enabled

D. The service type is NodePort instead of ClusterIP

Solution

1. Step 1: Check service port configuration

   The service exposes port 8080, but the curl command targets port 80, causing connection refusal.

2. Step 2: Understand port mapping importance

   Clients must use the service port, not the pod's internal port, to connect successfully.

3. Final Answer:

   The service port is 8080, but curl uses port 80 -> Option A

4. Quick Check:

   Port mismatch causes connection refused [OK]

Hint: Match curl port to service port exactly [OK]

Common Mistakes:

• Ignoring port mismatch between service and client
• Assuming network is disabled without checking
• Confusing service types with connectivity issues

5.

You want to ensure stable pod-to-pod communication in a Kubernetes cluster where pods restart frequently and get new IPs. Which approach best solves this problem?

hard

A. Use a Kubernetes Service to provide a stable DNS name and load balancing

B. Use pod IP addresses directly in application configuration

C. Configure pods to share the same static IP address

D. Use host networking mode for all pods

Solution

1. Step 1: Identify the problem with pod IPs

   Pods get new IPs on restart, so direct IP communication is unstable.

2. Step 2: Use Kubernetes Service for stability

   Services provide a stable DNS name and load balancing to reach pods regardless of IP changes.

3. Step 3: Evaluate other options

   Static IPs for pods are not practical; host networking breaks isolation; direct IP use is unreliable.

4. Final Answer:

   Use a Kubernetes Service to provide a stable DNS name and load balancing -> Option A

5. Quick Check:

   Service = stable pod communication [OK]

Hint: Use services for stable pod communication despite IP changes [OK]

Common Mistakes:

• Hardcoding pod IPs in configs
• Trying to assign static IPs to pods
• Using host networking unnecessarily