What is a Container Network Interface (CNI) plugin in Kubernetes?
❓ Interview Prompt: Explain CNI specification, pod IP allocation, overlay networking (VXLAN/IPIP), and the difference between Flannel, Calico, and Cilium eBPF.
CNI (Container Network Interface) is a specification and set of libraries for configuring network interfaces in Linux containers. Kubernetes delegates all Pod networking to a CNI plugin.
What CNI Does:
When a Pod is created on a node, kubelet calls the CNI plugin which:
CNI Plugin Comparison:
| Plugin | Networking | NetworkPolicy | Performance | Notes |
|---|---|---|---|---|
| Flannel | VXLAN overlay | ❌ No | Medium | Simple, widely used, no NetworkPolicy enforcement |
| Calico | IPIP/BGP | ✅ Yes | High | Popular for NetworkPolicy, uses BGP routing |
| Cilium | eBPF-native | ✅ Yes | Very High | eBPF bypasses iptables, service mesh capabilities |
| Weave | VXLAN mesh | ✅ Yes | Medium | Easy setup, auto-discovery |
Cilium's eBPF Advantage:
Traditional CNIs configure Linux iptables for routing (O(N) rule lookup). Cilium uses eBPF programs attached directly to kernel socket hooks — O(1) routing, 30%+ throughput improvement.
Code Implementation Example
# Install Cilium CNI in a new cluster
helm repo add cilium https://helm.cilium.io/
helm install cilium cilium/cilium \
--namespace kube-system \
--set kubeProxyReplacement=true # replace kube-proxy with eBPF!
# Verify Cilium is running
cilium status --wait
# Show pod networking (veth pairs and IPs)
kubectl exec -n kube-system -it cilium-xxxxx -- cilium endpoint list
# Observe network traffic in real-time (eBPF powered!)
cilium monitor --type drop # see dropped packets
# Test cross-node pod connectivity
kubectl run test-a --image=alpine --rm -it -- sh
# Inside: ping <pod-IP-on-another-node> ← should work via CNI overlayCNI plugins handle pod IP allocation and cross-node routing. Choose Cilium for maximum performance (eBPF bypasses iptables) + NetworkPolicy enforcement in production clusters.