Datapath Models: CCA practice questions

Cilium offers two ways to move pod traffic between nodes, plus special datapaths for some clouds, and the right choice depends on what the underlying network can do.

Encapsulation is what you get without any configuration. All nodes form a mesh of UDP tunnels, VXLAN by default on port 8472 or Geneve on port 6081 when tunnel-protocol is set to geneve, and the matching port must be open between nodes. The only requirement is that nodes can reach each other over IP, so the network does not need to know the pod CIDRs, nodes can span several routing domains, and new nodes join the mesh automatically. Tunnels also carry metadata: Cilium puts the source security identity in the header so the receiving node can skip one identity lookup. The cost is MTU. VXLAN adds 50 bytes to each packet, which lowers throughput; jumbo frames shrink the relative overhead. In the default overlay, traffic to a remote pod leaves through the cilium_vxlan interface.

Native routing is enabled with routing-mode: native and needs ipv4-native-routing-cidr, the range in which pod addresses are routable. Packets not addressed to a local endpoint are handed to the Linux routing table as if a local process had sent them, and Cilium turns on IP forwarding. The network must now route pod addresses. Either a router knows every pod CIDR and nodes use it as their default route, which is how cloud integrations work, or every node gets routes to every other node's pods. When all nodes share one layer 2 segment, auto-direct-node-routes: true installs those routes; across layer 3 boundaries a routing daemon such as BGP must distribute them. Per-endpoint routing, enable-endpoint-routes, routes traffic straight to each pod's veth instead of through cilium_host.

The AWS ENI datapath, selected with ipam: eni, gives pods addresses from Elastic Network Interfaces, so they are routable in the VPC without SNAT and can receive security groups. Its limits are the number of ENI addresses per instance type and EC2 API rate limits. On Google Cloud, gke.enabled=true switches on Kubernetes host scope IPAM, native routing and per-endpoint routes, using alias IP ranges.

Service traffic from outside the cluster has its own forwarding modes. By default NodePort and LoadBalancer traffic to a remote backend is SNAT-ed, so replies return through the receiving node. Setting loadBalancer.mode=dsr makes backends answer the client directly and keeps the client source address visible to policy, at the price of a lower advertised MTU; a hybrid mode uses DSR for TCP and SNAT for UDP.