Cilium is a Kubernetes-native networking, observability, and security solution built on eBPF. It provides CNI plugin functionality with overlay/native routing modes, distributed load balancing (replacing kube-proxy), cluster mesh for multi-cluster connectivity, identity-based network policies (L3-L7), service mesh with mutual authentication, and observability via Hubble (flow metrics, DNS insights). The architecture features a modular design using the Hive dependency injection framework, with components including the cilium-agent daemon, operator for CRD management, CLI tools for management/debugging, and API servers for inter-component communication. The data plane leverages eBPF/XDP for high-performance packet processing, while the control plane integrates deeply with Kubernetes through client-go, controller-runtime, and custom resource definitions.
Flannel is a layer 3 network fabric designed for Kubernetes that provides overlay networking between hosts. It runs a flanneld agent on each node to allocate subnet leases from a preconfigured address space using either Kubernetes API or etcd for storage. Traffic is forwarded via pluggable backend mechanisms including VXLAN, UDP, IPsec, host-gw, WireGuard, and cloud-specific integrations like Tencent VPC. The architecture separates concerns into backend management, subnet allocation, traffic management (iptables/nftables), and routing, with a plugin system enabling extensibility. Key entry points include the main daemon (main.go), backend registration system, subnet watchers, and traffic manager interfaces. The system handles IP address allocation, encapsulation, decapsulation, and traffic masquerading to enable pod-to-pod communication across nodes in a cluster.