I wonder the difference between kube-proxy and cni

Question

I wonder the difference between kube-proxy and cni.

1. Does calico also use iptables to set policies? In this case, the role overlaps with the kube-proxy, what's the difference between the two?

2. Why kube-proxy disable for Calico eBPF mode? Since kube-proxy uses iptables, do you disable kube-proxy that uses iptables to use eBPF?

3. If I disable kube-proxy, will the existing iptables policies be removed?

Thank you.

Answer 1

1. Calico defaults to using iptables to set network policies. Calico iptables chains/rules sit along side and integrate with the kube-proxy rules (when kube-proxy is in iptables mode).

2. The BPF code Calico implements intercepts the packets before the kube-proxy iptables rules are able to. You don't have to disable kube-proxy, but there is no reason to run kube-proxy (and the overhead of it managing iptables rules) once Calico can communicate directly with the kube-apiserver service and manage kubernetes services via BPF.

3. If kube-proxy is not running, it will not add any k8s iptables rules. If you have been left with rules after kube-proxy is shutdown, a manual iptables flush iptables --flush or a reload of your base iptables config will do. Otherwise a kube-proxy --cleanup.