How does Kubernetes networking work and what is the CNI?
How Kubernetes networking works: the flat pod network model, CNI plugins like Calico and Cilium, Services, kube-proxy, and NetworkPolicy segmentation.
Expected Interview Answer
Kubernetes networking gives every pod its own IP and requires that all pods communicate directly without NAT; the CNI (Container Network Interface) is the plugin standard Kubernetes uses to wire each pod into that flat network.
The Kubernetes network model has four rules: pods talk to pods across nodes without NAT, nodes talk to pods without NAT, each pod sees its own IP as others see it, and containers in a pod share a network namespace. Kubernetes itself does not implement the network — it delegates to a CNI plugin (Calico, Cilium, Flannel, Weave) that the kubelet invokes when a pod is created to allocate an IP and set up routes or an overlay. Services add stable virtual IPs and load balancing on top, implemented by kube-proxy (iptables/IPVS) or eBPF.
- Flat, NAT-free pod-to-pod connectivity
- Pluggable networking via a vendor-neutral CNI standard
- Stable Service IPs abstract away ephemeral pod IPs
- Network policies enforce segmentation
- Supports overlays or native routing depending on plugin
AI Mentor Explanation
Imagine a stadium where every player is given a permanent squad number and can pass directly to any other player without a runner in between. The CNI is the team manager who assigns each new player their number and shows them how to reach teammates on the field the moment they walk on, so passes flow freely across the whole ground.
Step-by-Step Explanation
Step 1
Pod gets scheduled
The scheduler places a pod on a node and the kubelet prepares to start its containers.
Step 2
kubelet calls the CNI
The kubelet invokes the configured CNI plugin (via /etc/cni/net.d config) to set up the pod's network namespace.
Step 3
IP allocation
The CNI plugin allocates a pod IP from the cluster CIDR and configures a veth pair, routes, or an overlay tunnel.
Step 4
Flat connectivity
Every pod can now reach every other pod by IP across nodes without NAT, satisfying the Kubernetes network model.
Step 5
Services and policy
kube-proxy or eBPF programs Service virtual IPs and load balancing; NetworkPolicies restrict which pods may talk.
What Interviewer Expects
- The four rules of the Kubernetes network model
- That every pod gets its own routable IP
- That Kubernetes delegates networking to a CNI plugin
- Examples of CNI plugins (Calico, Cilium, Flannel)
- How Services and kube-proxy sit above pod networking
Common Mistakes
- Thinking Kubernetes implements networking itself
- Believing pods communicate via NAT by default
- Confusing a Service ClusterIP with a pod IP
- Assuming containers in a pod have separate IPs
- Ignoring NetworkPolicy when discussing pod-to-pod traffic
Best Answer (HR Friendly)
“Kubernetes gives every application instance its own network address so they can all talk to each other directly, like everyone having a unique phone number. Kubernetes does not build that network itself — it plugs in a networking tool called a CNI that assigns the address and connects each new instance the moment it starts.”
Code Example
# CNI plugin config lives here on each node
ls /etc/cni/net.d/
cat /etc/cni/net.d/10-calico.conflist
# Each pod has its own IP from the cluster CIDR
kubectl get pods -o wide
# Test direct pod-to-pod connectivity (no NAT)
kubectl exec -it frontend-abc -- curl http://10.244.2.15:8080/healthz
# See the Service ClusterIP that fronts the pods
kubectl get svc backendapiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend
namespace: shop
spec:
podSelector:
matchLabels:
app: backend
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080Follow-up Questions
- What is the difference between an overlay CNI and a native-routing CNI?
- How does kube-proxy implement Service load balancing?
- What problem does a NetworkPolicy solve and which CNIs enforce it?
- How does Cilium's eBPF datapath differ from iptables-based kube-proxy?
- How do pods within the same pod share networking?
MCQ Practice
1. In the Kubernetes network model, how do pods on different nodes communicate?
The model requires all pods to reach each other directly by IP without NAT.
2. What does the CNI standard define?
CNI is the plugin interface used to allocate IPs and wire pods into the network.
3. Which component programs Service virtual IPs on nodes?
kube-proxy (using iptables or IPVS) implements Service ClusterIP load balancing on each node.
Flash Cards
Kubernetes network model core rule? — Every pod gets its own IP and all pods communicate without NAT.
What is the CNI? — Container Network Interface — the plugin standard the kubelet uses to wire pods into the network.
Name three CNI plugins — Calico, Cilium, Flannel (also Weave).
What does kube-proxy do? — Implements Service virtual IPs and load balancing via iptables or IPVS.
What enforces pod-to-pod segmentation? — NetworkPolicy, enforced by CNIs like Calico and Cilium.