Concepts·Certified Kubernetes Administrator
Choosing and Installing a CNI Plugin
Why a fresh kubeadm cluster has no pod network, what a CNI plugin actually installs, how to choose between Calico, Cilium and Flannel, and how to read what Calico did to your nodes: one address block per node, routes to its neighbours, and encapsulation it turns out not to be using.
Installation and Cluster Builds Guide 11 of 103 Intermediate
- OSUbuntu 26.04 LTS
- Kubernetes1.36.4
- Calicov3.32.1
- Pod CIDR10.244.0.0/16
- TimeAbout 30 min
- Reviewed21 August 2026
Written against the versions above. Interface names, block boundaries and VXLAN device IDs are generated per cluster and will differ on yours. The shape of the output is what to compare.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- A cluster built with
kubeadm init --pod-network-cidr=..., with or without a CNI already installed. kubectlaccess, and SSH to at least one node for the on-disk parts.- Knowing your node subnet. It changes which encapsulation mode does anything.
-
Why the cluster does not ship with one
-
Choosing: Calico, Cilium or Flannel
-
Install Calico, CRDs first
-
What it wrote to disk
-
One address block per node
-
The routes, and the encapsulation it is not using
-
What Calico runs, and where
-
Prove pods on different nodes can talk