CNI Plugin Comparison

Calico, Flannel, Cilium, Antrea CNI plugins — routing modes, NetworkPolicy support, performance, and selection criteria.

Overview

Overview CNI (Container Network Interface) is the standard interface between a container runtime and a network plugin. When a pod is created, the kubelet calls the CNI binary to allocate an IP, configure routes, and set up network policy. When a pod is deleted, CNI cleans up.

Major CNI plugins:

Flannel: the simplest CNI. VXLAN overlay by default (can also use host-gw for pure L3 routing on the same subnet). No NetworkPolicy support — requires a separate policy engine (Calico policy-only mode). Best for: small clusters, learning environments, or when simplicity outweighs features.

Calico: L3 routing with BGP. In BGP mode, Calico advertises pod CIDRs via BGP directly on the physical network — no overlay overhead. In VXLAN mode, works like Flannel but with full NetworkPolicy. eBPF dataplane available (replaces iptables). Supports: GlobalNetworkPolicy, HostEndpoint policy, Egress gateway. Best for: bare-metal, on-premises, performance-sensitive workloads.

Cilium: eBPF-native. Replaces kube-proxy for Service load balancing. Hubble provides L3/L4/L7 observability. Supports: L7 NetworkPolicy (HTTP method/path, gRPC service/method, Kafka topic), transparent encryption (WireGuard/IPSec), multi-cluster (ClusterMesh), bandwidth management. Best for: large-scale clusters, zero-trust security, observability.

Antrea: based on Open vSwitch (OVS). Tight VMware/vSphere integration. Supports NetworkPolicy with Antrea-native policies (ANP). Flows exported via IPFIX. Best for: VMware environments, vSphere with Tanzu.

Multus: meta-CNI that chains multiple CNI plugins. Pods can have multiple network interfaces (eth0 from Cilium + net1 from SR-IOV for high-performance workloads). Required for telco/NFV deployments.

Key concepts

BGP mode (Calico)
Calico advertises pod CIDRs via BGP to the physical network. Pods are directly routable without overlay encapsulation. Requires physical network routers to support BGP — not available in most cloud managed networks.
VXLAN mode
Overlay networking that encapsulates L2 frames in UDP (port 4789). Works on any IP network without BGP. All major CNIs support VXLAN mode. Adds 50-byte overhead per packet.
NetworkPolicy enforcement
CNI plugins vary in policy support. Flannel has none (needs Calico policy-only). Calico and Cilium enforce NetworkPolicy natively. Cilium extends to L7 (HTTP/gRPC/Kafka). Antrea uses ANP for additional policy types.
Multus
Meta-CNI that allows pods to have multiple network interfaces. Each interface is managed by a different CNI (e.g., eth0 by Cilium for cluster networking, net1 by SR-IOV for high-throughput data plane). Required for NFV and DPDK workloads.
eBPF dataplane
Calico and Cilium both offer eBPF modes that replace iptables/kube-proxy with BPF programs. O(1) Service lookup vs O(n) iptables. Cilium uses eBPF natively; Calico eBPF is an opt-in mode.

When to use it

  • Selecting a CNI plugin for a new Kubernetes cluster
  • Explaining why Cilium outperforms Calico BGP at 100k+ Services
  • Debugging network policy not being enforced (which CNI implements it?)
  • Justifying Multus for telco or GPU-accelerated networking use cases

Interview questions

  • How do you choose between Calico, Cilium, and Flannel for a Kubernetes cluster?
  • What is Multus CNI and when do you need it?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio