Flannel 0.8: Simplifying Kubernetes Overlay Networking

Introduction

CoreOS released Flannel 0.8 on September 6, 2017, focusing on stability and operational polish for one of Kubernetes’ earliest CNIs. Flannel’s promise remains the same—deliver a simple layer 3 network that “just works” across clouds and bare metal. Version 0.8 tightens VXLAN performance, improves health checks and smooths CNI integration.

What’s New in 0.8

• Unified CNI Plugin: Flannel’s CNI binaries now handle backend selection (VXLAN, host-gw, AWS VPC) with environment variables, cutting down on custom config files.
• Health Reporting: New /healthz endpoint surfaces backend status so operators can wire Flannel into monitoring/alerting pipelines.
• Backend Improvements:
  • VXLAN learns routes faster and reuses sockets, reducing CPU overhead on busy nodes.
  • host-gw backend detects route drift and repairs stale entries automatically.
  • AWS VPC backend integrates IAM auth for secondary ENI assignments.
• Kubeadm Friendly: Default manifest aligns with kubeadm conventions, running Flannel as a privileged DaemonSet with /etc/cni/net.d/10-flannel.conflist.
• Better Logging: Structured logs simplify parsing drops, encapsulation errors and subnet lease renewals.

Installation Snapshot

kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v0.8.0/Documentation/kube-flannel.yml

Adjust backend via ConfigMap:

net-conf.json: |
  {
    "Network": "10.244.0.0/16",
    "Backend": {
      "Type": "vxlan",
      "DirectRouting": false
    }
  }

Operational Notes

• Monitor /var/lib/cni/flannel for subnet leases; clean up leftover leases when decommissioning nodes.
• Use flannel --ip-masq with care—disable masquerading if your cloud routes pod CIDRs natively.
• Pair Flannel with the Kubernetes NetworkPolicy implementation of your choice (Calico, Cilium, kube-router) if you require policy enforcement; Flannel remains a pure connectivity fabric.
• For hybrid clusters, consider vxlan for cross-cloud nodes and host-gw for on-prem segments; 0.8’s auto-reboot detection keeps both backends reliable.

Summary