Comparison
Container Network InterfacevsOverlay network
Container Network Interface
a plugin you never chose gives every pod a routable address the moment it starts, and swapping it re-plumbs the whole cluster.
The specification and the plugin implementing it that attach each container to a network and hand it an address. It is why the orchestrator itself has no networking code and why two clusters with identical manifests can behave differently under load or under network policy. You meet it by name when addresses run out, when policy enforcement turns out to be unsupported, or when a plugin upgrade needs every node restarted.
Full entry →Overlay network
pod traffic is wrapped inside another packet to cross the real network, and you lose a few percent of throughput to the wrapper.
A virtual network built on top of the physical one by encapsulating pod packets, so pods get their own address space independent of the underlying subnets. It makes addressing simple and portable at the cost of encapsulation overhead and of traffic that packet captures on the real network cannot read. The alternative — giving pods addresses from the real network — is faster and exhausts your subnets much sooner.
Full entry →