Pattern 5: Pod ↔ Pod on Hybrid Nodes (VXLAN)

Pattern 5: Pod ↔ Pod on Hybrid Nodes (VXLAN) A sequence diagram generated by Archify. ① original packet 10.85.1.56 → 10.85.2.67 CNI looks up the destination pod IP to find its node (10.80.0.3) ② VXLAN encapsulation · outer header 10.80.0.2 → 10.80.0.3 · UDP 8472 ③ forwarded via route 10.85.2.0/24 [dynamic] via 10.80.0.3 ④ decapsulate and deliver to destination pod reply packet 10.85.2.67 → 10.85.1.56 VXLAN encapsulation 10.80.0.3 → 10.80.0.2 10.85.1.0/24 [dynamic] via 10.80.0.2 decapsulate and deliver to Pod A Node 1 → Node 2 (VXLAN) Node 2 → Node 1 (VXLAN) Pod A · 10.85.1.56 · Sequence participant Pod A 10.85.1.56 CNI · Node 1 · 10.80.0.2 · Pod CIDR 10.85.1.0/24 · Sequence participant CNI · Node 1 10.80.0.2 · Pod CIDR 10.85.1.0/24 Router · on-prem routing table · Sequence participant Router on-prem routing table CNI · Node 2 · 10.80.0.3 · Pod CIDR 10.85.2.0/24 · Sequence participant CNI · Node 2 10.80.0.3 · Pod CIDR 10.85.2.0/24 Pod B · 10.85.2.67 · Sequence participant Pod B 10.85.2.67 Legend Encapsulate / decapsulate Reply (Node 2 → Node 1) Router forwarding

Router routing table

  • • 10.80.0.0/16 [local] via eth0 (CONNECTED) — Remote Node CIDR
  • • 10.85.1.0/24 [dynamic] via 10.80.0.2 · 10.85.2.0/24 [dynamic] via 10.80.0.3
  • • 10.0.0.0/16 [static] via Gateway — route toward the VPC (not used in this flow)

VXLAN encapsulation

  • • Outer IP header uses the source/destination node IPs (10.80.0.2 → 10.80.0.3)
  • • UDP port 8472 (Cilium default) · VNI isolates pod network traffic
  • • The receiving node's CNI strips the VXLAN and outer headers and delivers the original packet to the destination pod