Networking
CNI flannel, Traefik ingress, ServiceLB, and policy enforcement.
Default CNI: Flannel
Why flannel
Lightest-weight CNI plugin with no external dependencies. Single binary, zero-config kernel routes.
Backends
VXLAN is default (works on most networks). WireGuard-Native and IPSec available via flag.
Pod IP allocation
Each node gets a /24 subnet. Pod-to-pod traffic routed via kernel — no overlay if your network supports it.
ServiceLB (K3s Built-in)
Replaces MetalLB
K3s ships a built-in load balancer that uses iptables + IPVS. Configure via Service type=LoadBalancer annotations.
Layer-2 mode
Announces IPs via ARP/NDP. Works on bare-metal and most on-prem networks.
Cloud integration
If you run on AWS/Azure, K3s auto-creates a cloud load balancer on first LoadBalancer service.
Ingress: Traefik
Default
Traefik is shipped and deployed as a DaemonSet by default. HTTP/HTTPS routes just work — no install needed.
Replacing it
Set --disable=traefik at server start, then install your own ingress controller (nginx-ingress, contour, etc.).
TLS
Traefik integrates with cert-manager automatically. Or use LetsEncrypt via the built-in ACME solver.
Network Policy
Enabled
Flannel does not enforce policy. Use Calico or Cilium for policy enforcement.
Steps
1. Install Calico CNI overlay. 2. Define NetworkPolicy resources. 3. Test with a probe pod.
When you need it
Multi-tenant clusters, sensitive workloads, compliance-driven isolation.
IPv6 / Dual-Stack
Dual-stack default
K3s 1.21+ supports IPv4+IPv6 dual-stack. Pods get both addresses.
Cluster CIDR
Set via --cluster-cidr at install (e.g., 10.42.0.0/16,fd00::/48).
Service CIDR
Likewise configurable via --service-cidr.