CKA — CNI Plugins

1 minute read

Why CNI Is Required

Kubernetes requires a Container Network Interface (CNI) plugin for Pod-to-Pod networking. Without it:

  • Nodes remain in NotReady status
  • CoreDNS Pods stay in Pending
  • Pods cannot communicate across nodes

CNI Plugin Comparison

CNI Plugin Default CIDR Network Policy Performance Notes
Calico 192.168.0.0/16 Yes High Most popular, recommended for CKA
Flannel 10.244.0.0/16 No Good Simple overlay, no NetworkPolicy
Cilium 10.0.0.0/8 Yes Very High eBPF-based, advanced features
Weave 10.32.0.0/12 Yes Good Easy setup, mesh network

Pod Network CIDR

The –pod-network-cidr in kubeadm init must match your chosen CNI plugin:

CNI Required –pod-network-cidr
Calico 192.168.0.0/16
Flannel 10.244.0.0/16
Cilium Not required (auto-configured)
Weave Not required (auto-configured) 
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/calico.yaml

Verify Calico

# Check Calico pods
kubectl get pods -n kube-system | grep calico

# All should be Running
# calico-kube-controllers-*   1/1   Running
# calico-node-*               1/1   Running (one per node)

Installing Flannel

If you initialized with –pod-network-cidr=10.244.0.0/16:

kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

Warning: Flannel does not support NetworkPolicies. If the exam requires NetworkPolicies, use Calico or Cilium instead.

Installing Cilium

# Using Cilium CLI
CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
curl -L --fail --remote-name-all \
  https://github.com/cilium/cilium-cli/releases/download/$CILIUM_CLI_VERSION/cilium-linux-amd64.tar.gz
sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin

cilium install
cilium status

Verify Network Connectivity

After installing the CNI:

# Check node status — should be Ready
kubectl get nodes

# Check system pods — all Running
kubectl get pods -n kube-system

# Create test pods and verify connectivity
kubectl run test1 --image=busybox --restart=Never -- sleep 3600
kubectl run test2 --image=busybox --restart=Never -- sleep 3600

# Wait for pods to be Running
kubectl get pods -o wide

# Test pod-to-pod communication
kubectl exec test1 -- ping -c 3 $(kubectl get pod test2 -o jsonpath='{.status.podIP}')

# Clean up
kubectl delete pod test1 test2

Exam tip: The CKA exam may ask you to install a specific CNI. Read the question carefully for the required CIDR and CNI plugin name.

Next: Hands-On Lab →

Updated:

You may also enjoy