[Comparative Analysis] Calico vs Cilium: Two CNI Giants Tackling eBPF in Kubernetes

In Kubernetes environments, the CNI (Container Interface) is the core interface that automatically configures the network environment for containers. Currently, kt cloud's Managed KS adopts the proven and stable Calico CNI as its Standard mode in operation.

Recently, eBPF (Extended Berkeley Packet Filter) technology has been gaining attention for high-performance networking. eBPF runs programs within the kernel, overcoming the limitations of the existing iptables approach's sequential rule inspection, and enables high-performance networking by instantly locating destinations through BPF Map.

Calico and Cilium differ in their philosophy toward eBPF.

• Calico (eBPF Optional): While maintaining the strengths of existing iptables and BGP-based routing, it offers eBPF as one selectable data plane option, providing high flexibility.
• Cilium (eBPF Native): Designed from the ground up with eBPF as a premise, it processes all logic as eBPF programs within the kernel, aiming for 'Zero kube-proxy'.

The key features and characteristics are as follows.

• kube-proxy Replacement: Calico synchronizes changes from the API server to the BPF Map through the Felix agent, while Cilium fully internalizes the functionality to perform optimized network control without kube-proxy.
• Observability: Calico uses a combination of Felix and open-source tools, while Cilium provides Hubble, which supports in-depth traffic visualization from L3 to L7.
• Security and Scalability: Cilium manages security policies using Identity-based security rather than IP-based methods, and is advantageous for implementing a Sidecarless service mesh.

However, both technologies share a common constraint: they require a recent Linux kernel of v5.3 or higher (v5.10 or higher recommended) to utilize eBPF.