CNI (Container Network Interface)

The Container Network Interface (CNI) is the standard way Kubernetes plugs pods into a network. When a pod starts, the node calls a CNI plugin, which creates the pod's network interface, gives it an IP address and sets up routes. Which plugin you run decides how pod IPs are allocated and which network policies are possible.

How it works

The kubelet asks the container runtime to create the pod sandbox, and the runtime calls the configured CNI plugin with an ADD command. The plugin allocates an IP from its pool, wires the interface into the node's network and returns the result. On deletion it gets a DEL and releases the IP.

With the AWS VPC CNI, pods get real VPC IP addresses from the node's network interfaces. An m5.large supports 3 interfaces with 10 IPv4 addresses each, so by default it can run 3 x (10 - 1) + 2 = 29 pods, however much CPU is free.

Why it matters in production

A pod stuck in ContainerCreating with network errors is often a CNI problem: the subnet ran out of IPs or the plugin is unhealthy. Plan pod address space before the cluster grows, and upgrade the CNI add-on along with the cluster version, because an outdated CNI can cause network outages after an upgrade.