Hands-on Lab·Certified Kubernetes Administrator
Calico Internals and Policy Enforcement
Pod networking stops being magic once you can see the pieces: a per-node IPAM block, one veth and one host route per Pod, a blackhole for the local block, and Felix rendering policy into the node's packet filter. All of it is readable with ip and kubectl.
Services and Networking Guide 64 of 103 Advanced
- Kubernetes1.36.4
- Calicov3.32.1
- EncapsulationVXLANCrossSubnet
- Cluster4 nodes
- TimeAbout 40 min
- Reviewed21 August 2026
Written against the versions above. An operator-installed Calico with VXLANCrossSubnet encapsulation. A manifest install or a BGP-mode install differs in the details, though the IPAM and routing model is the same.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- The Kubernetes network model guide.
- The CNI and Pod networking guide, which covers what a CNI plugin is asked to do.
- Shell access to a node, since half of this is read with
iprather thankubectl.
-
The pieces, and which of them is on every node
-
IPAM: Calico does not use the node's podCIDR
-
What the kubelet reads, and what it runs
-
One veth and one host route per Pod
-
CrossSubnet: the VXLAN device that is not being used
-
Felix, and the filter it writes