How does Container Networking deep dive work (CNI, IPAM, network namespaces)?

Question

Accepted Answer

**Deep dive into container networking:**

**Network Namespace:** Each container has isolated networking (own IP, routing table, iptables).
```bash
# Create namespace
ip netns add container1
ip netns list
ip netns exec container1 ip addr
```

**Veth Pair (virtual cable):**
```bash
# One side in the container, the other on the host
ip link add veth0 type veth peer name veth1
ip link set veth1 netns container1
ip addr add 10.0.0.1/24 dev veth0
ip link set veth0 up
ip netns exec container1 ip addr add 10.0.0.2/24 dev veth1
ip netns exec container1 ip link set veth1 up
```

**Bridge (switch):**
```bash
ip link add br0 type bridge
ip link set veth0 master br0
ip link set veth2 master br0
ip addr add 10.0.0.1/24 dev br0
ip link set br0 up
```

**CNI plugins:**
- **Calico**: BGP routing (without encapsulation), NetworkPolicy, eBPF mode.
- **Cilium**: eBPF-based, L7 visibility, built-in security.
- **Flannel**: VXLAN overlay (simple, but no NetworkPolicy).

**IPAM (IP Address Management):**
- **host-local**: static subnets.
- **calico-ipam**: dynamic IPs.
- **whereabouts**: for IPv6.

**Service networking (kube-proxy):**
- **iptables**: classic, slow for large clusters.
- **IPVS**: kernel-level LB, fast.
- **eBird (Cilium)**: eBPF-based, no kube-proxy.

DevOps: How does Container Networking deep dive work (CNI, IPAM, network namespaces)?