Why can Kubernetes Pods talk directly, and why still use Services?

One Pod can reach another without any Service. Here, web has the IP 10.244.1.5, and it sends a packet addressed straight to 10.244.2.7, which is api. The cluster network carries it across, and it's delivered. So why do Services exist at all?

Each node owns a slice of the Pod address space. Node A hands out IPs from 10.244.1.0/24, Node B from 10.244.2.0/24. So web gets 10.244.1.5 and api gets 10.244.2.7. No two Pods share an address, and traffic between them needs no NAT.

web sends a packet to 10.244.2.7, and Node A sees that address belongs to Node B's Pod range. The CNI plugin then routes or tunnels it across. Node B delivers it to api, and the reply returns the same way. The exact method depends on the plugin.

web on Node A sends to api's Pod IP on Node B. Does web need to know which node api runs on?

No, it just sends to the Pod IP. Node B's Pod range is already known to the cluster network, so the CNI routes or tunnels the packet there automatically. web only needs the destination Pod IP. Node IPs and NodePorts are for reaching the cluster from outside, not for traffic between Pods.

Kubernetes requires one flat network. Every Pod can reach every other Pod by IP, without NAT, and every CNI plugin must deliver that.

Then api gets replaced and lands on Node A with a new IP, 10.244.1.9. web still calls 10.244.2.7, and that call times out. Add several replicas, and web has no way to know which address to pick.

A Service fixes that by giving web one stable target: the name api and ClusterIP 10.96.0.20. Behind it, a label selector finds matching Pods, and the endpoint list updates as they come and go. Here, that's 10.244.1.9 and 10.244.2.8.

The web Pod asks CoreDNS for api and gets back 10.96.0.20. It sends traffic there, and rules on the node, programmed by kube-proxy or an equivalent, rewrite the destination to a live Pod IP, 10.244.1.9. After that, the same Pod network delivers it, and the reply comes back.

Pod IPs are reachable but disposable, and a Service is the stable address. Pods talk directly across nodes without NAT, but when they're replaced the IP changes. So call Services by DNS name, never hardcoded Pod IPs.