CNI Plugins: How to Pick One
Every Kubernetes cluster needs a CNI plugin to give pods IP addresses and let them talk to each other. But “just install a CNI” is bad advice. Each plugin makes different trade-offs, and picking the wrong one shows up later as a networking outage, a missing feature, or a performance ceiling you can’t fix without ripping out the network layer.
Here’s a practical look at the major CNI plugins in use today.
Flannel
Supports: Simple overlay networking (VXLAN by default). Easy to install, low resource footprint, stable for years.
Doesn’t support: Network policies on its own. No encryption. No advanced routing. If you need to restrict pod-to-pod traffic, Flannel can’t do it — you’d have to pair it with something like Calico for policy enforcement.
Use it when: You want the simplest possible setup for a dev/test cluster or a small cluster where security isolation between pods isn’t a requirement.
Calico
Supports: Network policies (including Kubernetes NetworkPolicy and its own extended policies), BGP-based routing without an overlay for better performance, encryption via WireGuard, and eBPF dataplane as an option.
Doesn’t support: Out of the box, it’s more complex to operate than Flannel — BGP peering and IP pool management need some understanding of routing.
Use it when: You need real network policy enforcement and want the option to scale into BGP-based routing for performance, without moving to a completely different plugin later. This is the most common production default for a reason.
Cilium
Supports: eBPF-based networking instead of iptables, which means lower latency and better performance at scale. L3–L7 network policies (you can write policies based on HTTP methods or gRPC calls, not just IPs and ports). Built-in observability via Hubble. Can replace kube-proxy entirely. Also does service mesh functions without a sidecar.
Doesn’t support: A learning curve — eBPF concepts and Cilium’s policy model take time to get comfortable with. Older kernels (below what eBPF needs) won’t work well.
Use it when: You care about performance at scale, want deep visibility into traffic, or need L7-aware policies. Increasingly the default in managed Kubernetes offerings (GKE Dataplane V2, several EKS and AKS setups use it).
AWS VPC CNI
Supports: Pods get real VPC IP addresses, so they’re routable like any other VPC resource — useful when other AWS services need to reach pods directly. Native integration with security groups per pod.
Get Jisna C John’s stories in your inbox
Join Medium for free to get updates from this writer.
Doesn’t support: Network policy by default (needs Calico installed alongside it for that). IP address exhaustion is a real constraint — you’re limited by ENI and secondary IP limits per instance type, which affects how many pods you can pack per node.
Use it when: You’re on EKS and need pods to be first-class citizens in your VPC, or you have services outside the cluster that need direct pod connectivity.
Multus
Not a full CNI by itself — it’s a meta-plugin that lets a pod have multiple network interfaces, each managed by a different CNI plugin.
Use it when: You have a specific requirement like a pod needing both a regular pod network interface and a dedicated high-throughput interface (common in telco/NFV and some ML workloads). Don’t reach for this unless you have that specific need.
Weave Net
Weave Net used to be a common choice for overlay networking with built-in encryption and policy support. The project’s repository was archived in mid-2024 and is no longer actively maintained. Avoid it for new clusters. If you’re running it today, plan a migration to Calico or Cilium.
How to actually choose
Don’t start with “which CNI is best.” Start with your requirements:
- Need network policies? Rule out Flannel. Go Calico or Cilium.
- Need L7-aware policies or deep traffic observability? Cilium.
- Running on EKS and need pods with real VPC IPs? AWS VPC CNI, paired with Calico if you also need policies.
- Want the safest, most battle-tested default with strong community support? Calico.
- Small dev cluster, no security requirements, want it to just work? Flannel.
- Pods need multiple network interfaces for specialized traffic? Multus, on top of whatever CNI you’re already running.
The CNI decision isn’t permanent, but changing it later means downtime and careful migration planning. Get the requirements list right before you pick.
