- Home
- Container Networking Software
- Cello CNI
Cello CNI
What it is
Cello CNI is a Kubernetes networking plugin for connecting cluster workloads within a Volcengine VPC. It creates Pod networks using secondary ENIs, with shared ENI and ENI multi-IP modes that both support Pod-to-Pod and Pod-to-Node communication. Cello integrates Cilium instead of kube-proxy, supporting ClusterIP, NodePort, and LoadBalancer services, as well as NetworkPolicy using eBPF programs on a Pod’s primary device. A Kubernetes device plugin reports available network resources to help the scheduler place Pods on nodes with capacity. Pod capacity varies by ECS instance type and ENI quotas, and exclusive ENI mode accommodates fewer Pods than shared ENI mode. Operators can configure the cluster or individual nodes, and selected settings can be changed without restarting Cello Pods. The project is free under the Apache 2.0 license. It requires Volcengine ECS, Kubernetes, and Helm 3.0 or later, with ECS kernel 4.19 or later; kubeadm is recommended for Kubernetes installation. Volcengine IAM permissions are needed for ECS and VPC operations.
For and against
For
- Supports Pod-to-Pod and Pod-to-Node communication.
- Integrates Cilium and supports common Kubernetes services.
- Supports NetworkPolicy with eBPF programs.
- Selected settings can change without restarting Cello Pods.
- Free and distributed under Apache 2.0.
Against
- Requires Volcengine ECS and IAM permissions.
- Requires Kubernetes and Helm 3.0 or later.
- Pod capacity depends on instance type and ENI quotas.
- Exclusive ENI mode supports fewer Pods than shared mode.
The verdict
Cello CNI provides VPC-based Pod networking with service support, policy controls, and configurable ENI modes. Deployment depends on Volcengine ECS, Kubernetes, Helm, and the required IAM permissions.
Who it suits
Cello CNI suits teams running Kubernetes workloads on Volcengine ECS that need VPC-based Pod networking and network policies. It is intended for Linux and self-hosted deployments.
Plans and prices
Cello CNI
Open source under Apache 2.0 · Requires Volcengine ECS and Kubernetes · Helm 3.0 required
Read 7 Oct 2026 · github.com
On the record
- Cloud integration
- Cello requires Volcengine IAM permissions to call ECS and VPC APIs for instance, ENI, IP address, and subnet operations.github.com · read 7 Oct 2026
- Communication
- Both network modes support Pod-to-Pod and Pod-to-Node communication.github.com · read 7 Oct 2026
- Configuration
- Cello supports cluster-wide and node-specific configuration, and selected settings can be changed at runtime without restarting Cello Pods.github.com · read 7 Oct 2026
- Deployment requirements
- The README specifies Volcengine ECS with kernel 4.19 or later, notes testing on veLinux 1.0 with kernel 5.10, and recommends kubeadm for Kubernetes installation.github.com · read 7 Oct 2026
- Installation
- The README instructs users to configure Cello and install it with Helm 3.0 or later.github.com · read 7 Oct 2026
- License
- Cello is distributed under the Apache 2.0 license.github.com · read 7 Oct 2026
- Network policy
- The project says its Cilium components support NetworkPolicy and use eBPF programs on a Pod's primary device.github.com · read 7 Oct 2026
- Pod networking
- Cello uses secondary ENIs to build Pod networks and supports shared ENI and ENI multi-IP modes.github.com · read 7 Oct 2026
- Purpose
- Cello is a Kubernetes CNI plugin based on the Volcengine VPC network that lets cluster workloads communicate within the VPC.github.com · read 7 Oct 2026
- Resource limit
- Pod capacity depends on the ECS instance type and ENI quotas; exclusive ENI mode supports fewer Pods than shared ENI mode.github.com · read 7 Oct 2026
- Scheduling
- Cello reports available network resources through a Kubernetes device plugin so the scheduler can place Pods on nodes with resources.github.com · read 7 Oct 2026
- Security reporting
- The security policy asks reporters to contact ByteDance's security team or [email protected] and not file public GitHub issues for vulnerabilities.github.com · read 7 Oct 2026
- Services
- Cello integrates Cilium in place of kube-proxy and supports ClusterIP, NodePort, and LoadBalancer services.github.com · read 7 Oct 2026
- Support
- The project directs questions and contributions to GitHub issues or pull requests and also mentions maintainer email and a Feishu group.github.com · read 7 Oct 2026
