How do pods access Apiserver which is actually outside of kubernetes?

[mogliang]

Since k3s run apiserver (6443) as hosts' process, the pods shall not be able to access the apiserver, but the fact is: the pods in k3s can access apiserver just through kuberentes service, this is quite interesting. Can someone tell me how can this happen?

[brandond]

Kube-proxy.

Look at the endpoints for the kubernetes service in the default namespace.

[mogliang]

Thanks @brandond,

What i'm trying to do is allow pod to access a local host port through service. I created endpoints and services just as how apiserver does, but doesn't work. Do I miss somethings somewhere?

apiVersion: v1
kind: Endpoints
metadata:
  labels:
    endpointslice.kubernetes.io/skip-mirror: "true"
  name: mylocalservice
  namespace: default
subsets:
- addresses:
  - ip: 172.31.96.28
  ports:
  - name: https
    port: 8088
    protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    component: mylocalservice
    provider: kubernetes
  name: mylocalservice
  namespace: default
spec:
  clusterIP: 10.43.0.2
  clusterIPs:
  - 10.43.0.2
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 8088
  sessionAffinity: None
  type: ClusterIP
status:
  loadBalancer: {}