Exploring Security Enhancements in Kubernetes CNI: A Deep Dive Into Network Policies

Authors:
Open Access
Publisher website
Google Scholar
Abstract
Container Network Interfaces (CNIs) are critical for securing containerized environments, yet their various security features and performance remain under-analyzed. This study presents an in-depth analysis of major CNI plugins (Cilium, Calico, WeaveNet, Kube-router, and Antrea) in Kubernetes environments. We first analyze their architectural characteristics and basic security features (encryption, multi-tenancy, etc.), and then perform a detailed examination of their network policy enforcement mechanisms. To understand the performance implications of policy enforcement, we evaluate Layer 3/4 policy processing, policy complexity scaling, pod scalability, and Layer 7 policy processing. Our results show clear patterns: eBPF-based Cilium maintains 8.9K Mbps throughput under complex L3/4 policies, but drops to 94 Mbps with L7 processing, while Antrea achieves 6.6K Mbps at L7 through HTTP filtering, although performance degrades as policy complexity increases. Under high concurrent pod loads, iptables-based CNIs show a 60-70% reduction in throughput, while Cilium maintains performance within 10% of baseline. These results highlight the trade-offs between architectural choices and security capabilities, and provide actionable insights for optimizing CNI selection based on cloud-native use cases.
Funding Information
  • Incheon National University Research Grant, in 2024

This publication has 21 references indexed in Scilit: