Terway
What it is
Terway is a free CNI plugin for Alibaba Cloud Kubernetes (ACK), built on Alibaba Cloud ENI technology. Each Pod receives its own network stack and IP address. Pods on the same ECS instance communicate directly, while traffic between ECS instances moves through VPC ENIs without VxLAN encapsulation. ENI mode allocates network interfaces to Pods to manage network resources and performance; trunking can provide independent ENIs for flexible security-group and switch configurations. Terway also supports node pools for exclusive ENI use, Kubernetes NetworkPolicy, traditional security groups, and dual-stack IPv4 and IPv6. The project uses eBPF for protocol-stack acceleration and describes the result as low latency and high throughput. It supports ACK, Alibaba Cloud VPC/ENI, Alibaba Cloud Linux 3/4, ContainerOS, and Ubuntu. A self-hosted Linux deployment is available, but trunking is unavailable in self-hosted clusters. The README marks VPC Network Mode and Exclusive ENI Mode as deprecated.
For and against
For
- Free CNI plugin for ACK.
- Supports Kubernetes NetworkPolicy and security groups.
- Supports dual-stack IPv4 and IPv6.
- Uses eBPF for protocol-stack acceleration.
Against
- Trunking is unavailable in self-hosted clusters.
- VPC Network Mode is deprecated.
- Exclusive ENI Mode is deprecated.
The verdict
Terway provides Pod networking and access-control options for Alibaba Cloud Kubernetes environments. Review the self-hosted trunking limitation and deprecated network modes when planning a deployment.
Who it suits
Terway suits teams running Kubernetes on Alibaba Cloud that need Pod networking and network access controls. Teams using self-hosted clusters should note that trunking is unavailable there.
Plans and prices
Open source
Trunking is unavailable in self-hosted clusters
Read 3 Oct 2026 · github.com
On the record
- Community support
- The README invites bug fixes, feature work, documentation improvements, and code contributions, and lists a DingTalk group ID of 35924643.github.com · read 3 Oct 2026
- Deprecated modes
- The README marks VPC Network Mode and Exclusive ENI Mode as deprecated.github.com · read 3 Oct 2026
- ENI mode
- ENI network mode allocates ENIs to Pods to optimize resource use and network performance.github.com · read 3 Oct 2026
- IP support
- Terway supports dual-stack IPv4 and IPv6.github.com · read 3 Oct 2026
- Network security
- Terway supports Kubernetes NetworkPolicy and traditional security groups for multi-dimensional network access control.github.com · read 3 Oct 2026
- Node pools
- Terway supports configuring node pools for exclusive ENI usage.github.com · read 3 Oct 2026
- Performance
- Terway uses eBPF for protocol stack acceleration and describes the result as low latency and high throughput.github.com · read 3 Oct 2026
- Pod networking
- Each Pod has its own network stack and IP address; Pods on the same ECS instance communicate directly, while cross-ECS Pod traffic travels through VPC ENIs without VxLAN encapsulation.github.com · read 3 Oct 2026
- Product
- Terway is a CNI plugin for Alibaba Cloud Kubernetes (ACK), built on Alibaba Cloud ENI technology.github.com · read 3 Oct 2026
- Security reporting
- The project asks users to report code vulnerabilities to [email protected] and refers to SECURITY.md for details.github.com · read 3 Oct 2026
- Self-hosted limitation
- The README says ACK-provided versions match the open-source version except that Trunking is unavailable in self-hosted clusters.github.com · read 3 Oct 2026
- Trunking
- Trunking allows Pods to have independent ENIs for flexible security group and switch configurations.github.com · read 3 Oct 2026
