Selecting a Network

Application scenarios

• Low performance requirements: As a container tunnel network requires additional VXLAN tunnel encapsulation, it has about 5% to 15% of performance loss when compared with the other two types of container networks. So, the container tunnel networks apply to the scenarios where high performance is not needed, such as web applications, and middle end and backend services with a small number of access requests.
• Large-scale networks: Different from a VPC network that is limited by the VPC route quota, a container tunnel network does not have any restriction on the infrastructure. In addition, the container tunnel network controls the broadcast domain at the node level. A cluster using a tunnel network supports a maximum of 2,000 nodes.

• High performance requirements: As no tunnel encapsulation is required, a VPC network delivers the performance close to that of a VPC when compared with a container tunnel network. So, the VPC networks apply to scenarios where high performance is needed, such as AI and big data computing.
• Small- and medium-scale networks: Due to the limitation on VPC route tables, it is recommended that the number of nodes in a cluster be less than or equal to 1,000.

• High performance requirements: Cloud Native 2.0 networks use VPC networks to build container networks. There is no need for tunnel encapsulation or NAT between container communications. This makes Cloud Native 2.0 networks ideal for scenarios where high bandwidth and low latency are needed.
• Large-scale networks: A cluster using a Cloud Native 2.0 network supports a maximum of 2,000 ECS nodes and 100,000 pods.

Core technology

OVS

IPvlan and VPC route

VPC network interfaces and supplementary network interfaces

Applicable cluster

CCE standard cluster

CCE standard cluster

CCE Turbo cluster

Container network isolation

Kubernetes-native network policies for pods

Not supported

Security group-based isolation for pods

Interconnecting pods to a load balancer

Interconnected through a NodePort

Interconnected through a NodePort

Directly interconnected using a dedicated load balancer

Interconnected using a shared load balancer through a NodePort

Pod IP address management

• Separate container CIDR blocks are needed. Container CIDR blocks cannot overlap with any VPC CIDR blocks.
• After a cluster is created, the container CIDR block cannot be expanded. To avoid insufficient IP addresses, you are advised to set the subnet mask of the container CIDR block to a maximum of 19 bits.

• Separate container CIDR blocks are needed. Container CIDR blocks cannot overlap with any VPC CIDR blocks.
• You can add multiple container CIDR blocks.
• After a cluster is created, you can add more container CIDR blocks.
• A fixed subnet is first assigned to each node from the container CIDR block. All pod IP addresses on each node are then assigned from the dedicated subnet.

• You can specify a VPC subnet as the container CIDR block.
• After a cluster is created, you can add more container CIDR blocks.
• Pod IP addresses are directly allocated from a VPC, consuming many IP addresses. You are advised to plan a large VPC CIDR block in advance.

Maximum number of pods on a node

It is determined by the maximum number of pods that can be created on a node (the kubelet parameter maxPods).

It is determined by the smaller value between the following options:

• The maximum number of pods that can be created on a node (the kubelet parameter maxPods).
• The number of pod IP addresses reserved for each node.

It is determined by the smaller value between the following options:

• The maximum number of pods that can be created on a node (the kubelet parameter maxPods).
• The number of network interfaces on a node.

Network performance

There is certain performance loss due to VXLAN encapsulation.

The performance is so good that it is comparable to that of the host network because there is no tunnel encapsulation, and cross-node traffic is forwarded through VPC routers. But there is a loss caused by NAT.

There is no performance loss because the container network is integrated with the VPC network.

Network scale

A maximum of 2,000 nodes is supported.

It is suitable for small- and medium-scale networks due to the limitation on VPC route tables. It is recommended that the number of nodes in a cluster be less than or equal to 1,000.

Each time a node is added to the cluster, a route is added to the VPC route tables. So, the cluster scale is limited by the VPC route tables. Evaluate the cluster scale before creating it.

A maximum of 2,000 nodes is supported.

In a cluster that uses a Cloud Native 2.0 network, pod IP addresses are assigned from the VPC CIDR block, so the number of pods is restricted by this CIDR block. Evaluate the cluster scale limitations before creating it.

Support for IPv4/IPv6

Supported

Not supported

Supported