Day 61: CNI landscape: Calico, Cilium, eBPF
CNI: who actually wires up Pod networking
The Container Network Interface (CNI) is the plugin interface Kubernetes uses to actually set up networking for each Pod — assigning IPs, wiring virtual interfaces, and (for some plugins) enforcing NetworkPolicies. Kubernetes itself implements none of this; it delegates entirely to whichever CNI plugin the cluster installs.
- Calico — mature, widely used, strong NetworkPolicy support, can run with or without an overlay network
- Cilium — built on eBPF (below) instead of traditional iptables rules, offering higher performance and much richer policy (including L7-aware rules)
- Flannel — simple overlay networking, historically popular, but no NetworkPolicy enforcement on its own
Why eBPF is eating this space
Traditional CNIs implement networking rules via iptables, which becomes a performance bottleneck at scale (rules are evaluated somewhat linearly, and thousands of Services/Policies means thousands of rules). eBPF lets you run sandboxed programs directly in the kernel, triggered on network events — Cilium uses this to implement routing and policy enforcement far more efficiently than iptables chains, which is why eBPF-based networking (and observability, Appendix D) has been steadily displacing iptables-based approaches in performance-sensitive clusters.
Key terms
- CNI
- The plugin interface Kubernetes uses to delegate Pod network setup to a specific implementation.
- eBPF
- A kernel technology for running sandboxed programs on network/system events, without the overhead of traditional iptables rule chains.
The Four Questions: eBPF-based CNI (Cilium)
Worked example for Docker: dependency hell → consistent runtime environments → VMs too heavy → shared kernel, weaker isolation. Apply it to eBPF-based networking: what problem (iptables rule-chain overhead at scale) did it solve, why couldn't traditional iptables solve it, and what trade-off (kernel version requirements, newer/less battle-tested tooling) does it introduce?
Phase 9 complete — you should now be able to
Why does an eBPF-based CNI like Cilium tend to outperform a traditional iptables-based CNI at large scale?
