Kubernetes networking & CNIs Interview Preparation Guide

Overlay networking encapsulates pod-to-pod packets inside UDP or IP headers (such as VXLAN or Geneve) before transmitting them across worker nodes, completely decoupling pod IP addresses from the physical network fabric. This simplifies setup and works across any cloud provider VPC. Conversely, direct routing (such as BGP with Calico) advertises pod IP subnets directly to top-of-rack physical network switches, allowing packets to travel natively without encapsulation overhead. While direct routing maximizes packet throughput and reduces CPU utilization, it requires close coordination with enterprise network administrators to manage physical switch routing tables and prevent IP overlap.

Kube-proxy in iptables mode programs linear rules into the Linux kernel netfilter framework for every port and endpoint combination of a Kubernetes Service. When a packet arrives, the kernel evaluates these rules sequentially in O(n) time complexity. As a cluster scales past 5,000 services, rule evaluation consumes excessive CPU cycles, and every pod creation or deletion triggers expensive global table updates across all cluster worker nodes. Switching kube-proxy to IPVS mode replaces linear iptables evaluation with O(1) hash table lookups, drastically reducing packet routing latency and CPU consumption in massive enterprise clusters.

Traditional CNIs rely on Linux kernel netfilter iptables hooks and virtual bridging layers to intercept, filter, and route packets between namespaces. eBPF-based CNIs like Cilium inject sandboxed bytecode programs directly into kernel hooks (such as XDP and Traffic Control), bypassing the netfilter stack entirely. This enables line-rate packet processing, eliminates connection tracking table bottlenecks, and allows transparent L7 policy enforcement and service mesh capabilities without sidecar proxy overhead, resulting in superior performance and lower resource utilization.

Intermittent 5-second DNS timeouts typically occur due to conntrack race conditions in the Linux kernel when concurrent UDP DNS requests from an application container share the same source port. This causes packet collision drops, forcing applications to wait for the standard 5-second UDP timeout before retrying. This issue is resolved by deploying NodeLocal DNSCache as a DaemonSet on every worker node to handle local caching and connection reuse, tuning `ndots` settings in pod resolv.conf, or scaling CoreDNS replicas horizontally to prevent CPU throttling.

A virtual Ethernet (veth) pair acts as a bidirectional virtual wire consisting of two interconnected network interfaces. When a container runtime creates a pod, one end of the veth pair is placed inside the isolated container network namespace (appearing as eth0), while the other end is anchored in the root network namespace of the host operating system. This allows packets generated inside the container namespace to traverse the virtual wire into the host root namespace, where CNI routing tables, iptables rules, or eBPF programs can forward them toward their ultimate destination.

Kubernetes NetworkPolicies are declarative API resources that configure namespaced ingress and egress firewall rules using podSelectors and namespaceSelectors. The underlying CNI plugin compiles these policies into kernel-level nftables, iptables, or eBPF filtering maps to drop unauthorized traffic between pods. Limitations include the requirement that the chosen CNI must natively support NetworkPolicies (e.g., Calico, Cilium), and the fact that policies do not apply to pods running with `hostNetwork: true` because they bypass container network namespaces entirely.

CNI IP Address Management (IPAM) allocates, tracks, and reclaims IP addresses assigned to pods across cluster nodes. Proper subnet block sizing (CIDR allocation per node) is critical because if block sizes are too small, clusters experiencing high pod creation and deletion churn will rapidly exhaust available IP addresses on worker nodes, causing pod scheduling failures. Conversely, oversized blocks waste valuable private IP address space, which can lead to severe IPv4 exhaustion in large enterprise cloud VPC environments.

When encapsulation protocols like VXLAN add 50+ bytes of headers to standard 1500-byte packets without corresponding MTU adjustments on node interfaces or pod veth pairs, the resulting packet exceeds the physical link MTU. The Linux kernel must either fragment the packet or rely on Path MTU Discovery (PMTUD). If ICMP fragmentation-needed messages are blocked by overzealous firewalls, packets are silently dropped, resulting in hanging TCP connections, failed TLS handshakes, and sluggish application file transfers.

NodeLocal DNSCache runs a DNS caching agent as a DaemonSet on each worker node, listening on a link-local IP address. Pods send DNS queries to this local cache rather than querying CoreDNS services across the network. If the local cache holds the record, it responds immediately, eliminating network hop latency. For cache misses, it queries CoreDNS using TCP, which avoids UDP conntrack race conditions and port exhaustion. This shields CoreDNS from overload and eliminates intermittent 5-second DNS timeouts.

CNI-native encryption encapsulates inter-node pod traffic using cryptographic protocols like WireGuard or IPsec, ensuring that data moving across untrusted physical network switches or public cloud backplanes is fully encrypted in transit. This provides robust compliance for zero-trust architectures and prevents packet sniffing between distinct tenants sharing the same physical infrastructure. The trade-off is a measurable increase in CPU utilization for cryptographic processing, which must be factored into node sizing.

Pods configured with `hostNetwork: true` share the network namespace of the host operating system rather than operating within an isolated container network namespace. Because CNI NetworkPolicies rely on veth interface hooks inside container namespaces to enforce firewall rules, host-networked pods completely bypass these mechanisms. Operators should avoid `hostNetwork: true` unless strictly required for low-level node monitoring daemons, and secure them using host-level firewall tools such as nftables, iptables, or system-level security profiles.

Flannel offers maximum simplicity with VXLAN/host-gw overlays but lacks advanced NetworkPolicies and high-scale performance optimizations. Calico provides mature enterprise features, robust NetworkPolicy enforcement, and flexible BGP direct routing or IPIP encapsulation options. Cilium delivers cutting-edge eBPF data path performance, O(1) service routing, advanced security observability, and transparent service mesh capabilities, but requires modern Linux kernel versions and a steeper operational debugging curve.