{"id":78877,"date":"2026-10-07T23:54:26","date_gmt":"2026-10-07T23:54:26","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=78877"},"modified":"2026-10-07T23:54:28","modified_gmt":"2026-10-07T23:54:28","slug":"kubernetes-networking-plugins-cni-plugins","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/kubernetes-networking-plugins-cni-plugins\/","title":{"rendered":"Kubernetes networking plugins\/CNI plugins"},"content":{"rendered":"\n

1. Kubernetes CNI \/ Network Plugins<\/h3>\n\n\n\n
Plugin<\/th>Type<\/th>AWS<\/th>Azure<\/th>GCP<\/th>On-Prem<\/th>Key Use<\/th><\/tr><\/thead>
Calico<\/strong><\/td>CNI + Network Policy<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>Networking + security policies<\/td><\/tr>
Cilium<\/strong><\/td>eBPF CNI<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>High-performance networking, security, observability<\/td><\/tr>
Flannel<\/strong><\/td>Basic CNI<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>Simple pod networking<\/td><\/tr>
Weave Net<\/strong><\/td>CNI<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>Pod networking<\/td><\/tr>
Canal<\/strong><\/td>Flannel + Calico<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>Networking + NetworkPolicy<\/td><\/tr>
Kube-OVN<\/strong><\/td>OVN\/SDN CNI<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>Advanced networking<\/td><\/tr>
Antrea<\/strong><\/td>OVS-based CNI<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>Enterprise networking\/security<\/td><\/tr>
Multus<\/strong><\/td>Meta-CNI<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>Multiple network interfaces<\/td><\/tr>
Whereabouts<\/strong><\/td>IPAM<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>Multi-network IP allocation<\/td><\/tr>
SR-IOV CNI<\/strong><\/td>Hardware CNI<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>\u2705<\/td>High-performance workloads<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

2. Cloud-native Kubernetes networking<\/h2>\n\n\n\n

AWS \/ EKS<\/h3>\n\n\n\n
Plugin<\/th>Layer<\/th>Purpose<\/th><\/tr><\/thead>
Amazon VPC CNI<\/strong><\/td>Pod \u2192 VPC<\/td>Native AWS networking<\/td><\/tr>
Cilium<\/strong><\/td>Pod \u2192 Node \u2192 VPC<\/td>eBPF networking\/security<\/td><\/tr>
Calico<\/strong><\/td>Pod networking\/policy<\/td>NetworkPolicy\/security<\/td><\/tr>
AWS Load Balancer Controller<\/strong><\/td>L7\/L4 ingress<\/td>ALB\/NLB<\/td><\/tr>
AWS VPC Lattice<\/strong><\/td>Service networking<\/td>Service-to-service connectivity<\/td><\/tr>
Kube-proxy<\/strong><\/td>Service networking<\/td>ClusterIP\/NodePort routing<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Typical EKS stack:<\/strong><\/p>\n\n\n

Internet\n   \u2502\nRoute 53\n   \u2502\nAWS WAF\n   \u2502\nALB \/ NLB\n   \u2502\nAWS Load Balancer Controller\n   \u2502\nKubernetes Service\n   \u2502\nkube-proxy \/ eBPF\n   \u2502\nCNI\n   \u2502\nAWS VPC CNI \/ Cilium\n   \u2502\nPod<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
3. Azure \/ AKS<\/h1>\n\n\n\n
Plugin<\/th>Layer<\/th>Purpose<\/th><\/tr><\/thead>
Azure CNI<\/strong><\/td>Pod \u2192 VNet<\/td>Native Azure networking<\/td><\/tr>
Azure CNI Overlay<\/strong><\/td>Pod networking<\/td>Overlay pod CIDRs<\/td><\/tr>
Cilium<\/strong><\/td>eBPF<\/td>Networking\/security<\/td><\/tr>
Calico<\/strong><\/td>Network policy<\/td>Security\/policy<\/td><\/tr>
Azure Application Gateway Ingress Controller<\/strong><\/td>L7<\/td>Application Gateway<\/td><\/tr>
Application Gateway for Containers<\/strong><\/td>L7<\/td>Modern ingress\/gateway<\/td><\/tr>
Azure Load Balancer<\/strong><\/td>L4<\/td>Service LoadBalancer<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Typical:<\/p>\n\n\n
Internet\n   \u2502\nAzure Front Door \/ WAF\n   \u2502\nApplication Gateway\n   \u2502\nAKS Service\n   \u2502\nCilium \/ kube-proxy\n   \u2502\nAzure CNI\n   \u2502\nPod<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
4. GCP \/ GKE<\/h1>\n\n\n\n
Plugin<\/th>Layer<\/th>Purpose<\/th><\/tr><\/thead>
GKE Dataplane V2<\/strong><\/td>eBPF<\/td>Pod networking\/security<\/td><\/tr>
Cilium<\/strong><\/td>eBPF<\/td>Advanced networking<\/td><\/tr>
Calico<\/strong><\/td>Network policy<\/td>Security<\/td><\/tr>
GKE VPC-native networking<\/strong><\/td>VPC<\/td>Alias IP-based pod networking<\/td><\/tr>
GKE Gateway Controller<\/strong><\/td>L7\/L4<\/td>Gateway API<\/td><\/tr>
GKE Ingress<\/strong><\/td>L7<\/td>Google Cloud Load Balancer<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
GKE’s Dataplane V2 is based on eBPF\/Cilium technology<\/strong>, making it particularly interesting if you’re learning modern Kubernetes networking.<\/p>\n\n\n\n
\n\n\n\n
5. OpenShift \/ Red Hat<\/h1>\n\n\n\n
For OpenShift<\/strong>, the networking landscape is slightly different.<\/p>\n\n\n\n
Plugin<\/th>Purpose<\/th><\/tr><\/thead>
OVN-Kubernetes<\/strong><\/td>Default OpenShift networking<\/td><\/tr>
OpenShift SDN<\/strong><\/td>Legacy networking<\/td><\/tr>
Multus<\/strong><\/td>Multiple network interfaces<\/td><\/tr>
SR-IOV Network Operator<\/strong><\/td>High-performance networking<\/td><\/tr>
Whereabouts<\/strong><\/td>IPAM for secondary networks<\/td><\/tr>
Cilium<\/strong><\/td>Possible alternative in appropriate environments<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Typical OpenShift:<\/p>\n\n\n\n
                    Internet\n                       \u2502\n                  Load Balancer\n                       \u2502\n                OpenShift Router\n                       \u2502\n              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n              \u2502                 \u2502\n          Service           Service\n              \u2502                 \u2502\n              \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                       \u2502\n                 OVN-Kubernetes\n                       \u2502\n                  Pod Network<\/code><\/pre>\n\n\n\n
\n\n\n\n
6. Networking by OSI \/ Kubernetes layer<\/h1>\n\n\n\n
This is probably the most useful way to categorize them<\/strong> for DevOps\/SRE learning.<\/p>\n\n\n\n
Layer 1 \u2014 Physical \/ NIC<\/h3>\n\n\n
NIC\n \u2502\n \u251c\u2500\u2500 Ethernet\n \u251c\u2500\u2500 SR-IOV\n \u2514\u2500\u2500 DPDK<\/code><\/span><\/pre>\n\n\n
Relevant Kubernetes technologies:<\/p>\n\n\n\n
    \n
  • SR-IOV CNI<\/li>\n\n\n\n
  • DPDK<\/li>\n\n\n\n
  • Multus<\/li>\n<\/ul>\n\n\n\n
    \n\n\n\n
    Layer 2 \u2014 Data Link<\/h3>\n\n\n
    Ethernet\n   \u2502\nLinux Bridge\n   \u2502\nOVS<\/code><\/span><\/pre>\n\n\n
    Technologies:<\/p>\n\n\n\n
      \n
    • Open vSwitch<\/li>\n\n\n\n
    • Linux Bridge<\/li>\n\n\n\n
    • OVN<\/li>\n\n\n\n
    • VLAN<\/li>\n\n\n\n
    • VXLAN<\/li>\n<\/ul>\n\n\n\n
      \n\n\n\n
      Layer 3 \u2014 Pod networking<\/h3>\n\n\n\n
      This is where the CNI<\/strong> operates.<\/p>\n\n\n
      Pod\n \u2502\nCNI\n \u2502\n \u251c\u2500\u2500 Calico\n \u251c\u2500\u2500 Cilium\n \u251c\u2500\u2500 Flannel\n \u251c\u2500\u2500 Antrea\n \u251c\u2500\u2500 OVN-Kubernetes\n \u251c\u2500\u2500 AWS VPC CNI\n \u2514\u2500\u2500 Azure CNI<\/code><\/span><\/pre>\n\n\n
      \n\n\n\n
      Layer 3\/4 \u2014 Routing<\/h3>\n\n\n\n
      Technologies:<\/p>\n\n\n\n
        \n
      • Linux routing<\/li>\n\n\n\n
      • BGP<\/li>\n\n\n\n
      • IP-in-IP<\/li>\n\n\n\n
      • VXLAN<\/li>\n\n\n\n
      • Geneve<\/li>\n\n\n\n
      • eBPF<\/li>\n\n\n\n
      • kube-proxy<\/li>\n\n\n\n
      • IPVS<\/li>\n\n\n\n
      • nftables<\/li>\n<\/ul>\n\n\n\n
        Examples:<\/p>\n\n\n
        Calico \u2192 BGP \/ VXLAN \/ IPIP\nCilium \u2192 eBPF\nOVN \u2192 Geneve \/ OVN\nFlannel \u2192 VXLAN<\/code><\/span><\/pre>\n\n\n
        \n\n\n\n
        Layer 4 \u2014 Service networking<\/h3>\n\n\n
        Pod\n \u2502\nService\n \u2502\n \u251c\u2500\u2500 ClusterIP\n \u251c\u2500\u2500 NodePort\n \u2514\u2500\u2500 LoadBalancer<\/code><\/span><\/pre>\n\n\n
        Technologies:<\/p>\n\n\n\n
          \n
        • kube-proxy<\/li>\n\n\n\n
        • iptables<\/li>\n\n\n\n
        • IPVS<\/li>\n\n\n\n
        • nftables<\/li>\n\n\n\n
        • Cilium eBPF<\/li>\n<\/ul>\n\n\n\n
          \n\n\n\n
          Layer 7 \u2014 Ingress \/ Gateway<\/h3>\n\n\n
          Internet\n    \u2502\n    \u25bc\nIngress \/ Gateway\n    \u2502\n    \u25bc\nService\n    \u2502\n    \u25bc\nPod<\/code><\/span><\/pre>\n\n\n
          Popular implementations:<\/p>\n\n\n\n
            \n
          • NGINX Ingress<\/li>\n\n\n\n
          • HAProxy<\/li>\n\n\n\n
          • Traefik<\/li>\n\n\n\n
          • Kong<\/li>\n\n\n\n
          • Envoy Gateway<\/li>\n\n\n\n
          • Istio Gateway<\/li>\n\n\n\n
          • AWS Load Balancer Controller<\/li>\n\n\n\n
          • GKE Gateway Controller<\/li>\n\n\n\n
          • Azure Application Gateway<\/li>\n<\/ul>\n\n\n\n
            \n\n\n\n
            7. Service Mesh layer<\/h1>\n\n\n\n
            Above the basic Kubernetes networking layer:<\/p>\n\n\n\n
            Technology<\/th>Proxy<\/th>Main Purpose<\/th><\/tr><\/thead>
            Istio<\/strong><\/td>Envoy<\/td>Service mesh<\/td><\/tr>
            Linkerd<\/strong><\/td>Linkerd proxy<\/td>Lightweight service mesh<\/td><\/tr>
            Consul<\/strong><\/td>Envoy<\/td>Service networking<\/td><\/tr>
            Cilium Service Mesh<\/strong><\/td>eBPF\/Envoy<\/td>Networking + mesh<\/td><\/tr>
            Kuma<\/strong><\/td>Envoy<\/td>Service mesh<\/td><\/tr>
            NGINX Service Mesh<\/strong><\/td>NGINX<\/td>Service mesh<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
            Architecture:<\/p>\n\n\n\n
                             \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                 \u2502   Service Mesh   \u2502\n                 \u2502 Istio \/ Linkerd  \u2502\n                 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                          \u2502\n                 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25bc\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                 \u2502 Ingress\/Gateway  \u2502\n                 \u2502 NGINX \/ Envoy    \u2502\n                 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                          \u2502\n                 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25bc\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                 \u2502 Kubernetes       \u2502\n                 \u2502 Service          \u2502\n                 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                          \u2502\n                 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25bc\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                 \u2502 CNI              \u2502\n                 \u2502 Cilium\/Calico    \u2502\n                 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                          \u2502\n                 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25bc\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                 \u2502 Node \/ VPC       \u2502\n                 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/code><\/pre>\n\n\n\n
            The shortlist I’d learn<\/h2>\n\n\n\n
            For a modern Kubernetes networking roadmap<\/strong>, I’d prioritize:<\/p>\n\n\n\n
            1. Cilium<\/strong> \u2192 modern eBPF networking
            2. Calico<\/strong> \u2192 networking + NetworkPolicy + BGP
            3. AWS VPC CNI<\/strong> \u2192 essential for EKS
            4. Azure CNI<\/strong> \u2192 essential for AKS
            5. GKE Dataplane V2<\/strong> \u2192 essential for modern GKE
            6. OVN-Kubernetes<\/strong> \u2192 essential for OpenShift
            7. Multus<\/strong> \u2192 multiple interfaces\/networks
            8. SR-IOV CNI<\/strong> \u2192 high-performance networking
            9. NGINX\/Envoy Gateway<\/strong> \u2192 L7 networking
            10. Istio<\/strong> \u2192 service-mesh networking<\/p>\n\n\n\n
            For your AWS\/EKS + OpenShift + Kubernetes<\/strong> work, the particularly important combination is:<\/p>\n\n\n\n
                                Kubernetes Networking\n                           \u2502\n        \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n        \u2502                  \u2502                  \u2502\n       CNI              Service             L7\n        \u2502               Network             Network\n        \u2502                  \u2502                  \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2510      kube-proxy       Ingress\/Gateway\n \u2502      \u2502      \u2502      \/ eBPF            \u2502\nCilium Calico AWS      \u2502          NGINX \/ Envoy\n \u2502      \u2502      VPC CNI \u2502\n \u2502      \u2502              \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502\n        Cloud Network\n             \u2502\n     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n     \u2502       \u2502        \u2502\n    AWS    Azure     GCP\n     \u2502       \u2502        \u2502\n    VPC     VNet      VPC<\/code><\/pre>\n\n\n\n
            This gives you a cloud \u2192 VPC\/VNet \u2192 node \u2192 CNI \u2192 pod \u2192 service \u2192 ingress \u2192 service mesh<\/strong> view, which is the cleanest way to understand Kubernetes networking end-to-end.<\/p>\n","protected":false},"excerpt":{"rendered":"
            1. Kubernetes CNI \/ Network Plugins Plugin Type AWS Azure GCP On-Prem Key Use Calico CNI + Network Policy \u2705 \u2705 \u2705 \u2705 Networking + security policies… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-78877","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=78877"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78877\/revisions"}],"predecessor-version":[{"id":78878,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78877\/revisions\/78878"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=78877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=78877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=78877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}