| Resource | Purpose |
|---|---|
| Service | Stable network endpoint in front of a set of pods (selected by labels) |
| Service types | ClusterIP (internal), NodePort (exposes via node IP), LoadBalancer (cloud LB), ExternalName (DNS alias) |
| Ingress | HTTP/HTTPS routing into the cluster (hostnames, paths). Needs an Ingress Controller (nginx, Traefik, ALB Controller) |
| NetworkPolicy | Firewall rules between pods (requires CNI support, e.g., Cilium) |