Addresses and subnets

An IPv4 address is 32 bits, and "/24" says how many of them name the network. Read a CIDR block bit by bit, then write a firewall rule that lets in one node's pods and nothing else.

Runs in your browser On your machine

15 min+35 XP for finishing

An IPv4 address like 10.244.1.37 looks like four numbers. It’s really one 32-bit number, written a byte at a time so people can read it (RFC 791). Each of the four parts is 8 bits, so each runs from 0 to 255. That’s why 10.244.1.256 isn’t an address.

Routers don’t look at addresses one by one. They look at prefixes: the first few bits, which say which network an address belongs to. CIDR notation writes the prefix length after a slash (RFC 4632):

10.244.1.0/24 means “every address whose first 24 bits match 10.244.1”. The last 8 bits are free, so that’s 256 addresses.
10.244.0.0/16 fixes 16 bits and frees 16: 65,536 addresses.
/32 is exactly one address. /0 is all of them.

Each bit you take off the prefix doubles the block. A /23 is two /24s side by side, which is why 10.244.0.0/23 covers both 10.244.0.x and 10.244.1.x.

Visual guideHow a cluster splits its addresses

The cluster owns one big pod range. kind uses 10.244.0.0/16 by default: 65,536 addresses.
Each node gets its own /24 slice of it - 256 addresses. Every pod on worker has an address starting 10.244.1.
Services get a separate range that never overlaps the pods. An address alone tells you whether it is a pod or a Service.

Read the bits

Type any address with a prefix. The blue bits are the network part, the grey bits are free for hosts. Try 10.244.1.37/24, then change only the prefix to /23 and /25 and watch the range grow and shrink.

Address / prefix

Mission · a firewall rule for one node · +40 XP

A database should accept connections from pods on worker only. Pods get addresses from their node's slice of the cluster's pod range (10.244.0.0/16).

Pods by node
node	pod addresses	rule says

Allow from

Find worker's slice: put one of its pod addresses in the calculator with its node prefix
Write a rule that lets every worker pod in
...and keeps every other pod out

Private, public and the odd ones

Three ranges are set aside for private networks. They’re never routed on the public internet, so every home, office and cluster can reuse them (RFC 1918):

Range	Size	Where you’ll see it
`10.0.0.0/8`	16.7 million	clusters, corporate networks, kind’s pods
`172.16.0.0/12`	1 million	container and cloud networks - and the one people misremember
`192.168.0.0/16`	65,536	most home routers

The middle one catches people out: /12 covers 172.16.x.x to 172.31.x.x only. 172.32.0.1 is a public address.

A few more show up often enough to recognise on sight (RFC 6890 keeps the full list). 127.0.0.0/8 is loopback, this machine talking to itself. 169.254.0.0/16 is link-local, which usually means “no DHCP server answered”, though cloud providers also put their metadata service at 169.254.169.254. 100.64.0.0/10 is shared address space used for carrier-grade NAT.

Check yourself+10 XP

Which address is NOT private?

Check yourself+10 XP

A firewall rule allows 10.244.0.0/23. Which pods can get through?

Do it for real · your machine+50 XP bonus

Everything above ran in your browser. Now do it on a real cluster withthe tilt platform. You need Docker, kind and Tilt, about 15 GB of free disk and 8 GB of spare RAM. Setup guide · Can my machine run it?

With the tilt platform up, read the real slices off your own cluster:

kubectl get nodes -o custom-columns=NODE:.metadata.name,PODCIDR:.spec.podCIDR
kubectl get pods -A -o wide | head -20      # the IP column: which node's slice?
kubectl get svc -A | head -10               # Service addresses: a different range

Each pod’s address falls inside its node’s podCIDR, and every Service address sits outside the pod range entirely.

Self-reported. We can't see your machine, and we don't want to. This is a bonus, never required.

Sources

Finished reading?

Missions and quizzes above earn their own XP. This marks the lesson done.