--- title: How to Build Kubernetes Networking Without Kubernetes:... description: Kubernetes delegates all packet routing to a Container Network Interface (CNI) plugin — the cluster won't even reach Ready state without one. This hands-on... canonical: https://daily.dev/posts/how-to-build-kubernetes-networking-without-kubernetes-do-what-the-cni-does-by-hand-y3kbv2lkj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Build Kubernetes Networking Without Kubernetes: Do What the CNI Does By Hand | daily.dev og:description: Kubernetes delegates all packet routing to a Container Network Interface (CNI) plugin — the cluster won't even reach Ready state without one. This hands-on... og:url: https://daily.dev/posts/how-to-build-kubernetes-networking-without-kubernetes-do-what-the-cni-does-by-hand-y3kbv2lkj og:image: https://api.daily.dev/og/posts/Y3kbV2Lkj.png og:image:alt: How to Build Kubernetes Networking Without Kubernetes: Do What the CNI Does By Hand og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Build Kubernetes Networking Without Kubernetes: Do What the CNI Does By Hand **[freeCodeCamp](https://daily.dev/sources/freecodecamp)** · 23 min read · 8 upvotes · 0 comments ## Summary Kubernetes delegates all packet routing to a Container Network Interface (CNI) plugin — the cluster won't even reach Ready state without one. This hands-on guide builds Kubernetes-style pod networking from scratch using raw Linux primitives: veth pairs to connect isolated network namespaces, a Linux bridge to scale to multiple containers on one host, and static routes plus IP forwarding to bridge two real VMs. Each step deliberately breaks first so you feel the exact problem CNIs solve. The guide then explains why direct routing fails in cloud VPCs and how advanced CNIs like Cilium use VXLAN/Geneve overlays and eBPF to work around those restrictions at scale. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does a Kubernetes node stay NotReady until a CNI is installed? Kubernetes has zero built-in ability to route packets between pods; it only schedules workloads and manages state in etcd. Without an external CNI plugin, the kubelet reports NetworkReady=false with the reason NetworkPluginNotReady, keeping every node NotReady until a plugin like Calico or Cilium is applied to handle the actual packet plumbing. _Anyone debugging a stuck cluster bootstrap can dig into CNI mechanics like this on daily.dev._ ### Why do pods on two different Kubernetes nodes fail to reach each other with only bridges and no routing configured? Each node builds its own isolated Linux bridge and pod subnet, so a packet leaving one node's bridge hits the host's default route toward the LAN gateway, which has no idea how to reach the other node's pod subnet, and gets dropped with 100% packet loss. Adding a static route on each host pointing the other's pod subnet at its physical IP fixes this by letting hosts forward packets directly to each other. _Developers troubleshooting cross-node pod connectivity can explore networking deep dives like this on daily.dev._ ### Why do simple static routes for pod networking break in cloud environments like AWS or GCP? Cloud VPCs do not allow arbitrary IP addresses to roam across their network fabric, so pod subnet traffic that isn't explicitly registered gets treated as illegitimate and dropped. Cilium works around this by encapsulating pod packets inside VXLAN or Geneve overlays addressed between nodes' physical IPs, making the traffic look like normal host-to-host communication that passes VPC restrictions, while also using eBPF for near line-rate performance. _Engineers choosing a CNI for cloud clusters can compare these tradeoffs further on daily.dev._ ## Similar posts on daily.dev - [Understanding Kubernetes Networking](https://daily.dev/posts/understanding-kubernetes-networking-oooxha7or) · cilium · 22 upvotes · 1 comments - [Kubernetes Networking Explained: From ClusterIP to Cilium Service Mesh](https://daily.dev/posts/kubernetes-networking-explained-from-clusterip-to-cilium-service-mesh-rhwqkcwdn) · freeCodeCamp · 5 upvotes · 1 comments - [What Is Kubernetes Networking?](https://daily.dev/posts/what-is-kubernetes-networking--1qghzles9) · Isovalent · 15 upvotes · 0 comments - [Kubernetes Networking Explained Without the Hand-Waving](https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi) · Medium · 5 upvotes · 1 comments - [Inside the Packet: How Kubernetes Networking Actually Works at L3/L4](https://daily.dev/posts/inside-the-packet-how-kubernetes-networking-actually-works-at-l3-l4-mlktkkrux) · Container Journal · 1 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#cilium](https://daily.dev/tags/cilium) [View this post on daily.dev](https://daily.dev/posts/how-to-build-kubernetes-networking-without-kubernetes-do-what-the-cni-does-by-hand-y3kbv2lkj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Build Kubernetes Networking Without Kubernetes: Do What the CNI Does By Hand","url":"https://daily.dev/posts/how-to-build-kubernetes-networking-without-kubernetes-do-what-the-cni-does-by-hand-y3kbv2lkj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-build-kubernetes-networking-without-kubernetes-do-what-the-cni-does-by-hand-y3kbv2lkj"},"datePublished":"2026-07-23T05:40:36.223Z","dateModified":"2026-09-13T18:41:05.849Z","description":"Kubernetes delegates all packet routing to a Container Network Interface (CNI) plugin — the cluster won't even reach Ready state without one. This hands-on...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/69b7bf2d2db0c10729a408fa9610a23a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/69b7bf2d2db0c10729a408fa9610a23a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"freeCodeCamp","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"freeCodeCamp","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1628412854/logos/freecodecamp","url":"https://daily.dev/sources/freecodecamp"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-build-kubernetes-networking-without-kubernetes-do-what-the-cni-does-by-hand-y3kbv2lkj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":8},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,cilium","timeRequired":"PT23M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"freeCodeCamp","item":"https://daily.dev/sources/freecodecamp"},{"@type":"ListItem","position":3,"name":"How to Build Kubernetes Networking Without Kubernetes: Do What the CNI Does By Hand"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-build-kubernetes-networking-without-kubernetes-do-what-the-cni-does-by-hand-y3kbv2lkj#faq","mainEntity":[{"@type":"Question","name":"Why does a Kubernetes node stay NotReady until a CNI is installed?","acceptedAnswer":{"@type":"Answer","text":"Kubernetes has zero built-in ability to route packets between pods; it only schedules workloads and manages state in etcd. Without an external CNI plugin, the kubelet reports NetworkReady=false with the reason NetworkPluginNotReady, keeping every node NotReady until a plugin like Calico or Cilium is applied to handle the actual packet plumbing. Anyone debugging a stuck cluster bootstrap can dig into CNI mechanics like this on daily.dev."}},{"@type":"Question","name":"Why do pods on two different Kubernetes nodes fail to reach each other with only bridges and no routing configured?","acceptedAnswer":{"@type":"Answer","text":"Each node builds its own isolated Linux bridge and pod subnet, so a packet leaving one node's bridge hits the host's default route toward the LAN gateway, which has no idea how to reach the other node's pod subnet, and gets dropped with 100% packet loss. Adding a static route on each host pointing the other's pod subnet at its physical IP fixes this by letting hosts forward packets directly to each other. Developers troubleshooting cross-node pod connectivity can explore networking deep dives like this on daily.dev."}},{"@type":"Question","name":"Why do simple static routes for pod networking break in cloud environments like AWS or GCP?","acceptedAnswer":{"@type":"Answer","text":"Cloud VPCs do not allow arbitrary IP addresses to roam across their network fabric, so pod subnet traffic that isn't explicitly registered gets treated as illegitimate and dropped. Cilium works around this by encapsulating pod packets inside VXLAN or Geneve overlays addressed between nodes' physical IPs, making the traffic look like normal host-to-host communication that passes VPC restrictions, while also using eBPF for near line-rate performance. Engineers choosing a CNI for cloud clusters can compare these tradeoffs further on daily.dev."}}]} ```