Flannel CNI

Flannel is a popular Container Network Interface (CNI) plugin that provides a simple and efficient way to create an overlay network for Kubernetes clusters. Flannel is a default CNI installed by Talos Linux, and it can be overridden with other CNI implementations if desired (e.g. Cilium, Calico, etc.). Flannel encapsulates the network traffic between pods using VXLAN (Talos default), which allows for seamless communication between pods across different nodes in the cluster without requiring any additional configuration on the underlying network infrastructure. With Flannel, kube-proxy handles the routing of traffic between pods and services, while Flannel manages the overlay network and ensures that pods can communicate with each other regardless of their physical location in the cluster. Starting with Talos 1.13, Flannel can be configured to support Network Policies.

Configure Flannel to support network policies

Depending on your Talos version your Flannel CNI can be configured to support Network Policies with the following configuration:

Talos v1.14+
Talos v1.13

For Talos 1.14 and later, enable Flannel Network Policies using the KubeFlannelCNIConfig document:

apiVersion: v1alpha1
kind: KubeFlannelCNIConfig
kubeNetworkPoliciesEnabled: true

For Talos versions earlier than 1.14, use the legacy machine configuration:

cluster:
  network:
    cni:
      name: flannel
      flannel:
        kubeNetworkPoliciesEnabled: true

Once you have enabled network policies in your Flannel CNI you can deploy a network policy to restrict traffics to specific pods.

Example network policy

In the example below, the network policy allow-api-to-web restricts ingress traffic to pods with the label app: web in the default namespace, allowing only traffic from pods with the label app: api:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-to-web
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: web
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: api
      ports:
        - protocol: TCP
          port: 80

Apply the policy:

kubectl apply -f network-policy.yaml

Once applied, only pods with the label app: api can reach port 80 on pods labeled app: web. All other ingress traffic to those pods is denied.

Network policies require kubeNetworkPoliciesEnabled: true in the Flannel configuration as shown above. Without this setting, NetworkPolicy resources are accepted but not enforced.

Customize your Flannel configuration

Most Flannel customization is available directly through the KubeFlannelCNIConfig document — including the backend type, backend port, and MTU. For example, to change the backend from the default VXLAN to host-gw:

apiVersion: v1alpha1
kind: KubeFlannelCNIConfig
backendType: host-gw

See the KubeFlannelCNIConfig reference for the full set of configurable fields. If you need to customize Flannel beyond what KubeFlannelCNIConfig exposes, you can deploy a custom Flannel manifest using Omni’s manifest sync feature.

Deploy a fully custom Flannel manifest with Omni

Follow these steps to deploy a custom Flannel manifest through an Omni cluster template: Step 1. Download the upstream Flannel manifest:

curl -Lo flannel.yaml https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

Step 2. Edit flannel.yaml to customize the Flannel configuration. For example, to change the backend from VXLAN to host-gw, find the net-conf.json section in the ConfigMap and update it:

{
  "Network": "10.244.0.0/16",
  "Backend": {
    "Type": "host-gw"
  }
}

Step 3. Reference the manifest in your Omni cluster template. Set the default CNI to none so Talos does not install its own Flannel:

Talos v1.14+
Talos < v1.14

For Talos v1.14 and later, disable the default CNI with the KubeFlannelCNIConfig document:

On Talos versions earlier than v1.14, disable the default CNI with cni.name: none:

Step 4. Apply the cluster template:

omnictl cluster template sync --file cluster-template.yaml

Using mode: full ensures that Omni continuously syncs the manifest, so any changes you make to the Flannel configuration in the cluster template are applied to the cluster automatically. See Sync Kubernetes Manifests for more details. Talos Linux ships with all necessary base CNI plugins for Flannel, so a default Flannel installation done by Talos can be replaced with a custom one based on Flannel documentation.

Overview

CNI

CSI

Security

Monitoring & Observability

Advanced Guides

Configure Flannel to support network policies

Example network policy

Customize your Flannel configuration

Deploy a fully custom Flannel manifest with Omni

​Configure Flannel to support network policies

​Example network policy

​Customize your Flannel configuration

​Deploy a fully custom Flannel manifest with Omni

Configure Flannel to support network policies

Example network policy

Customize your Flannel configuration

Deploy a fully custom Flannel manifest with Omni