> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Flannel CNI
> In this guide you will learn about Flannel CNI on Talos.
export const k8s_release = '1.37.0';
[Flannel](https://github.com/flannel-io/flannel) is a popular Container Network Interface (CNI) plugin that provides a simple and efficient way to create an overlay network for Kubernetes clusters.
Flannel is a default CNI installed by Talos Linux, and it can be overridden with other CNI implementations if desired (e.g. [Cilium](./deploying-cilium), [Calico](./deploy-calico), etc.).
Flannel encapsulates the network traffic between pods using VXLAN (Talos default),
which allows for seamless communication between pods across different nodes in the cluster without requiring any additional configuration on the underlying network infrastructure.
With Flannel, `kube-proxy` handles the routing of traffic between pods and services, while Flannel manages the overlay network and ensures that pods can communicate with each other regardless of their physical location in the cluster.
Starting with Talos 1.13, Flannel can be configured to support [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/).
## Configure Flannel to support network policies
Depending on your Talos version your Flannel CNI can be configured to support Network Policies with the following configuration:
For Talos 1.14 and later, enable Flannel Network Policies using the [`KubeFlannelCNIConfig`](../../talos/v1.14/reference/configuration/kubernetes/kubeflannelcniconfig) document:
```yaml theme={null}
apiVersion: v1alpha1
kind: KubeFlannelCNIConfig
kubeNetworkPoliciesEnabled: true
```
For Talos versions earlier than 1.14, use the legacy machine configuration:
```yaml theme={null}
cluster:
network:
cni:
name: flannel
flannel:
kubeNetworkPoliciesEnabled: true
```
Once you have enabled network policies in your Flannel CNI you can deploy a network policy to restrict traffics to specific pods.
### Example network policy
In the example below, the network policy `allow-api-to-web` restricts ingress traffic to pods with the label `app: web` in the `default` namespace, allowing only traffic from pods with the label `app: api`:
```yaml theme={null}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-api-to-web
namespace: default
spec:
podSelector:
matchLabels:
app: web
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: api
ports:
- protocol: TCP
port: 80
```
Apply the policy:
```bash theme={null}
kubectl apply -f network-policy.yaml
```
Once applied, only pods with the label `app: api` can reach port 80 on pods labeled `app: web`. All other ingress traffic to those pods is denied.
Network policies require `kubeNetworkPoliciesEnabled: true` in the Flannel configuration as shown above. Without this setting, NetworkPolicy resources are accepted but not enforced.
## Customize your Flannel configuration
Most Flannel customization is available directly through the `KubeFlannelCNIConfig` document — including the backend type, backend port, and MTU. For example, to change the backend from the default VXLAN to host-gw:
```yaml theme={null}
apiVersion: v1alpha1
kind: KubeFlannelCNIConfig
backendType: host-gw
```
See the [`KubeFlannelCNIConfig` reference](../../talos/v1.14/reference/configuration/kubernetes/kubeflannelcniconfig) for the full set of configurable fields.
If you need to customize Flannel beyond what `KubeFlannelCNIConfig` exposes, you can deploy a custom Flannel manifest using Omni's [manifest sync](../../omni/cluster-management/sync-kubernetes-manifests) feature.
### Deploy a fully custom Flannel manifest with Omni
Follow these steps to deploy a custom Flannel manifest through an Omni cluster template:
**Step 1.** Download the upstream Flannel manifest:
```bash theme={null}
curl -Lo flannel.yaml https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml
```
**Step 2.** Edit `flannel.yaml` to customize the Flannel configuration. For example, to change the backend from VXLAN to host-gw, find the `net-conf.json` section in the ConfigMap and update it:
```json theme={null}
{
"Network": "10.244.0.0/16",
"Backend": {
"Type": "host-gw"
}
}
```
**Step 3.** Reference the manifest in your Omni cluster template. Set the default CNI to `none` so Talos does not install its own Flannel:
For Talos v1.14 and later, disable the default CNI with the `KubeFlannelCNIConfig` document:
{`kind: Cluster\nname: my-cluster\nkubernetes:\n version: ${k8s_release}\n manifests:\n - name: flannel\n file: flannel.yaml\n mode: full\npatches:\n - name: disable-default-cni\n inline:\n apiVersion: v1alpha1\n kind: KubeFlannelCNIConfig\n $patch: delete\n...\n# Include machines for template`}
On Talos versions earlier than v1.14, disable the default CNI with `cni.name: none`:
{`kind: Cluster\nname: my-cluster\nkubernetes:\n version: ${k8s_release}\n manifests:\n - name: flannel\n file: flannel.yaml\n mode: full\npatches:\n - name: disable-default-cni\n inline:\n cluster:\n network:\n cni:\n name: none\n...\n# Include machines for template`}
**Step 4.** Apply the cluster template:
```bash theme={null}
omnictl cluster template sync --file cluster-template.yaml
```
Using `mode: full` ensures that Omni continuously syncs the manifest, so any changes you make to the Flannel configuration in the cluster template are applied to the cluster automatically. See [Sync Kubernetes Manifests](../../omni/cluster-management/sync-kubernetes-manifests) for more details.
Talos Linux ships with all necessary base CNI plugins for Flannel, so a default Flannel installation done by Talos can be replaced with a custom one based on [Flannel documentation](https://github.com/flannel-io/flannel).