Understanding Kubernetes: Part 36 Container Network Interface (CNI)

---

📢 If you’ve been following our Kubernetes series 2025, welcome back! For new readers, check out Part 35 Readiness Probe

Container Network Interface (CNI) in Kubernetes

The Container Network Interface (CNI) is a standardized networking framework that allows Kubernetes to manage networking for containers efficiently. CNI is crucial for pod-to-pod communication, service discovery, and traffic routing within a Kubernetes cluster.

Before CNI, networking in Kubernetes was tightly coupled with the container runtime. CNI decouples the networking layer, making it easier to integrate different networking solutions without modifying Kubernetes core components.

Why is CNI Important?

1. Standardization — Provides a uniform way to configure networking across different container runtimes.

2. Extensibility — Enables Kubernetes to use various network plugins like Calico, Flannel, Cilium, Weave, etc.

3. Dynamic Configuration — Automatically assigns IPs and manages routing as pods scale up and down.

4. Isolation & Security — Supports network policies for traffic control between pods.

5. Performance Optimization — Some CNI plugins provide eBPF-based networking, which reduces overhead and increases performance.

How CNI Works in Kubernetes

CNI operates as a plugin-based architecture where each CNI plugin provides networking capabilities for Kubernetes pods. When a pod is created, Kubernetes requests the CNI plugin to configure the network namespace for the pod.

CNI Responsibilities:

1. Assign IP Addresses — Each pod gets a unique IP within the cluster.

2. Configure Routes — Ensures pods can communicate across nodes.

3. Enforce Network Policies — Restricts access between pods for security.

4. Manage Overlay Networks — Some CNI plugins create virtual networks for better scalability.

5. Support Load Balancing — Handles traffic distribution for services.

---

CNI Components in Kubernetes

A Kubernetes CNI setup consists of:

1. CNI Plugin — The networking implementation (e.g., Calico, Flannel, Cilium).

2. CNI Daemon — Manages CNI operations on each node.

3. Kubelet Integration — Calls the CNI plugin to set up networking for new pods.

4. IPAM (IP Address Management) — Assigns and releases IPs dynamically.

5. Network Policies — Defines traffic rules for pod-to-pod communication.

Capabilities of CNI

• Pod-to-Pod Communication — Ensures all pods can communicate within the cluster.

• Cross-Node Networking — Enables pods running on different nodes to connect.

• Network Policies — Controls which pods can talk to each other.

• Service Discovery & Load Balancing — Helps expose services within and outside the cluster.

• eBPF Support — Some plugins like Cilium use eBPF for high-performance networking.

• Customizability — Different plugins support different features like encryption, multi-networking, and QoS.

---

Example: Checking CNI Health in Kubernetes

To check if CNI is working properly, use the following commands:

List Installed CNI Plugins

ls /opt/cni/bin/

This lists all available CNI plugins on the node.

Check CNI Network Configuration

cat /etc/cni/net.d/*.conf

This displays the CNI configuration used by Kubernetes.

List Network Interfaces for a Running Pod

kubectl exec -it <pod-name> -- ip a

This shows the IP addresses assigned to the pod.

Check Pod Network Connectivity

kubectl exec -it <pod-name> -- ping <another-pod-ip>

This verifies if pods can communicate with each other.

---

Real-World Usage of CNI in Kubernetes

In my previous role as a DevOps Engineer, I managed Calico CNI for Kubernetes networking. Key tasks included:

• Troubleshooting pod communication issues using kubectl exec and ip a.

• Implementing network policies to restrict access between namespaces.

• Optimizing networking performance by migrating from Flannel to Cilium for eBPF-based traffic handling.

• Monitoring network health using Prometheus metrics from the CNI plugin.

By leveraging CNI, we ensured a scalable, secure, and high-performance networking environment for our Kubernetes clusters.

---

Example: YAML Configuration for CNI in Kubernetes

Install a CNI Plugin (Calico Example)

kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

This installs Calico CNI for managing Kubernetes networking.

Define a Network Policy to Restrict Traffic

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: web
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: frontend
      ports:
        - protocol: TCP
          port: 80

• This policy allows only frontend pods to communicate with web pods on port 80

🚀 Ready to Master Kubernetes?

Take your Kubernetes journey to the next level with the Master Kubernetes: Zero to Hero course! 🌟 Whether you’re a beginner or aiming to sharpen your skills, this hands-on course covers:

✅ Kubernetes Basics — Grasp essential concepts like nodes, pods, and services. ✅ Advanced Scaling — Learn HPA, VPA, and resource optimization. ✅ Monitoring Tools — Master Prometheus, Grafana, and AlertManager. ✅ Real-World Scenarios — Build production-ready Kubernetes setups.

🔥 Flash Sale: Buy Kubernetes Course, Get Terraform FREE! Limited Time Offer!

🔥 Start Learning Now: [Join the Master Kubernetes Course + FREE Access to Terraform Course](https://cloudops0.gumroad.com/l/k8s)

Don’t miss your chance to become a Kubernetes expert! 💻✨

🚀 Stay ahead in DevOps and SRE! 🔔 Subscribe now and never miss a beat on Kubernetes and more. 🌟

🚀 Master Terraform: Infrastructure as Code

🔥 Start Learning Now: Join the Master Terraform Course

Apply Code DEVOPS20 for 20% OFF!