How does a package go from an external client to a pod in another namespace?

When an external client sends a packet to a pod in Kubernetes that is in a different namespace, the following path occurs:

1. External client sends a request to the external IP or DNS name of the service (for example, Ingress or LoadBalancer).
2. Ingress Controller or LoadBalancer type Service receives the request and directs it inside the cluster.
3. Inside the cluster, the request hits a Service, which is an abstraction over pods. A Service in Kubernetes has a ClusterIP and can be configured to route traffic to pods in a specific namespace.
4. The Service uses kube-proxy to route the packet to one of the pods that match the service's selectors.
5. The packet is delivered directly to the selected pod in the required namespace.

It is important to note that a namespace is a logical isolation, but within the cluster, all namespaces can interact with each other if permitted by network policies. To access a service in another namespace, the full service name is usually used: service-name.namespace.svc.cluster.local.

Example of accessing from a pod in the frontend namespace to a service in the backend namespace:

curl http://my-service.backend.svc.cluster.local

Thus, the packet passes through the external entry point, the Kubernetes service, and kube-proxy to reach the pod in another namespace.