What CNI Actually Is
Kubernetes does not come with a built-in network implementation. Instead, it defines a standard called the Container Network Interface (CNI) — a specification that describes what a networking plugin must do when Kubernetes asks it to set up or tear down a Pod's network.
Think of CNI as a job description. Kubernetes says: "I'm about to create a Pod on this node. Your job is to give it an IP address, connect it to the right virtual network interface, and ensure it can reach every other Pod in the cluster." The CNI plugin does the actual work.
When you bootstrap a cluster (with kubeadm, for example), you must install a CNI plugin yourself. Without one, every Pod you create will sit in Pending state indefinitely — the kubelet cannot complete Pod setup without a working network.
Common CNI Choices
Flannel is the simplest option. It creates an overlay network using VXLAN (a tunneling protocol that wraps Pod traffic inside UDP packets). The physical network only ever sees node-to-node traffic. Flannel is easy to set up and works almost everywhere, but it does not support Network Policies — a significant limitation for production security.
Calico is the most widely deployed production CNI. It can operate in overlay mode (IP-in-IP tunneling) or in native Layer 3 routing mode using BGP (Border Gateway Protocol), where physical routers learn Pod IP routes directly. Calico is also the gold standard for Network Policy enforcement.
Cilium is the modern high-performance choice. Instead of manipulating iptables rules (which grow linearly and become slow at scale), Cilium uses eBPF — a Linux kernel technology that lets you run sandboxed programs directly in the kernel. This gives Cilium native-speed packet processing, deep observability (you can see exactly which Pod is talking to which), and security enforcement without the overhead of iptables.
AWS VPC CNI, Azure CNI, GKE Dataplane V2 are cloud-provider-specific plugins that assign real VPC IP addresses to Pods, making them first-class citizens on the cloud network. This eliminates overlay overhead entirely but ties you to that cloud provider.
Interviewers frequently ask: "What happens if you don't install a CNI plugin?" The answer is that Pods will remain in Pending state because the kubelet cannot complete the network setup phase. A follow-up question is often: "How would you choose between Flannel, Calico, and Cilium?" Frame your answer around three axes: simplicity (Flannel), policy enforcement + routing flexibility (Calico), and performance at scale + observability (Cilium with eBPF).