<p>Calico pod communication</p>

🧱 1. The Core Infrastructure Components

Before any traffic moves, Calico and Kubernetes set up the landscape:

The veth Pairs: For every Pod created, Calico creates a virtual ethernet cable. One end sits in the Pod's network namespace; the other end sits in the host namespace (named caliXXXXX).
The Map (Routing Table): Calico’s agent (Felix) pre-populates the Linux kernel’s native routing table (ip route). It writes rules mapping every Pod IP to its specific caliXXXXX interface.
The Security Guard (Netfilter/iptables): Calico and kube-proxy inject custom sub-chains (starting with cali- and KUBE-) directly into the kernel's native Netfilter hooks.

🕒 2. The Strict Order of Operations

When a packet travels from Pod 1 to a Service VIP, it triggers Netfilter hooks and routing decisions in a strict, unchangeable timeline:

Hook 1: PREROUTING (The Entry Checkpoint)

kube-proxy hits first: It intercepts the virtual Service VIP and executes DNAT, rewriting the destination address to a Real Backend Pod IP.
Calico hits immediately after: It runs its cali-PREROUTING chain. It inspects the packet after DNAT and applies Ingress Network Policies.
Action: It either permits the packet or drops it instantly to save CPU cycles.

Step 2: The Routing Decision (The Intersection)

The Linux Kernel takes over: The kernel looks at the packet's destination (the Real Pod IP).
The Map Lookup: It references the routing table that Calico pre-configured.
Action: The kernel matches the Pod IP and determines the exact exit interface (caliXXXXX for same-host, or a physical NIC like eth0 for cross-host).

Hook 3: FORWARD (The Transit Lane)

The Context: Because the packet is crossing from one network interface namespace to another, the kernel routes it through the FORWARD hook.
Calico hits here: It runs its cali-FORWARD chain to validate transit safety.
Action: It double-checks that Pod 1 is allowed to talk to Pod 2. If a policy blocks it, the packet is killed here.

Hook 4: POSTROUTING (The Exit Gate)

The Context: The packet has been routed and cleared by security. It is sitting at the exit interface, ready to leave.
Calico/kube-proxy hit here: They run the cali-POSTROUTING chain to enforce Egress Network Policies.
Action: If the packet is exiting the cluster to the external internet, SNAT (Masquerading) is applied at the very last second, rewriting the source IP to the Node's IP so replies can find their way back.

🎯 3. Visual Execution Flow

[ Packet Leaves Pod 1 via veth ] ──► Enters Host Namespace
                                           │
                                           ▼
 ┌─────────────────────────────────────────────────────────────────────────────────┐
 │ KERNEL HOOKS & CALICO INTERACTION                                               │
 │                                                                                 │
 │ 1. PREROUTING HOOK                                                              │
 │    ├──► kube-proxy: DNAT (VIP ──► Real Pod 2 IP)                                │
 │    └──► Calico: Checks Ingress Policy ──► [ALLOW / DROP]                        │
 │                                                                                 │
 │ 2. ROUTING DECISION                                                             │
 │    └──► Linux Kernel: Reads Calico's pre-written routing table                  │
 │    └──► Destination matched ──► Target Interface locked in                      │
 │                                                                                 │
 │ 3. FORWARD HOOK                                                                 │
 │    └──► Calico: Checks Transit/Inter-pod Policy ──► [ALLOW / DROP]              │
 │                                                                                 │
 │ 4. POSTROUTING HOOK                                                             │
 │    ├──► Calico: Checks Egress Policy ──► [ALLOW / DROP]                         │
 │    └──► kube-proxy/Calico: Applies SNAT (only if traffic leaves node/cluster)   │
 └─────────────────────────────────────────────────────────────────────────────────1
                                           │
                                           ▼
[ Packet Enters Target veth ] ──► Arrives safely at Pod 2!

💡 4. The Golden Rules to Remember

Linux Kernel does the driving: Calico never routes a packet mid-flight. The kernel does the routing based on a map Calico drew ahead of time.
Calico is the firewall: Calico's primary job inside the Netfilter hooks is executing immediate Allow/Deny decisions based on your Network Policies.
DNAT changes the target, Routing finds the path, SNAT changes the source: DNAT happens first so the kernel knows where to route the packet. SNAT happens last so it doesn't mess up the routing decision or Calico's policy evaluation. [1]

Now that you have the complete summary, where would you like to go next?

We can look at how this changes if you switch Calico to VXLAN/IPIP Overlay mode instead of native routing.
We can look at how Calico's eBPF mode deletes all of these iptables hooks entirely for faster networking

Calico Pod Communication