DevOps & Kubernetes (50 Qs)•Part 2: Kubernetes Architecture & Core Workloads (11 - 25)
Kubernetes Networking Model & CNI: IP-per-Pod, Calico vs. Cilium (eBPF) vs. Cloud VPC CNI.
The Kubernetes Networking Invariants
Every Kubernetes CNI (Container Network Interface) plugin must adhere to three fundamental rules:
- All Pods can communicate with all other Pods on any node without NAT.
- All agents on a node (e.g. Kubelet) can communicate with all Pods on that same node.
- The IP that a Pod sees itself as is the same IP that all other Pods see it as.
scss
Node 1 (192.168.1.10) Node 2 (192.168.1.20)
+---------------------------------+ +---------------------------------+
| [Pod A: 10.244.1.5] | | [Pod B: 10.244.2.8] |
| | (veth) | | | (veth) |
| [ CNI Network Plugin ] | | [ CNI Network Plugin ] |
| | | | | |
| [ eth0: 192.168.1.10 ] | | [ eth0: 192.168.1.20 ] |
+---------------------------------+ +---------------------------------+
\ /
\==== Direct Routing / VXLAN =====/
CNI Plugin Comparison
| CNI Plugin | Mechanism | Strengths | Limitations |
|---|---|---|---|
| Cilium | eBPF (Extended Berkeley Packet Filter) | Replaces iptables directly inside the Linux kernel. Unmatched throughput, sub-millisecond latency, built-in L7 NetworkPolicy, Hubble network observability. | Requires modern Linux kernel (5.4+). |
| Calico | BGP (Border Gateway Protocol) or VXLAN/IP-in-IP | Industry benchmark for granular NetworkPolicies, highly mature, supports hybrid on-prem / cloud. | Uses iptables or IPVS (higher CPU overhead at 10k+ services). |
| AWS VPC CNI | Secondary ENI IP Allocation | Assigns real AWS VPC private IPs directly to Pods. Zero overlay encapsulation overhead; native integration with AWS security groups. | Risk of VPC subnet IP exhaustion; limits pod density per EC2 instance type. |