Cello CNI vs Flannel
Cello CNI
github.comFlannel
github.comSide by side
| Figure | Cello CNI | Flannel |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | — | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Container Networking Software | 7.9 (#6) | 7.8 (#10) |
| Network policy | The project says its Cilium components support NetworkPolicy and use eBPF programs on a Pod's primary device. | Flannel does not natively enforce network policies, but its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it. |
| Purpose | Cello is a Kubernetes CNI plugin based on the Volcengine VPC network that lets cluster workloads communicate within the VPC. | Flannel provides a layer 3 network fabric for containers designed for Kubernetes. |
| Security reporting | The security policy asks reporters to contact ByteDance's security team or [email protected] and not file public GitHub issues for vulnerabilities. | The security policy directs vulnerability reports to GitHub private vulnerability reporting and says maintainers acknowledge reports within seven days. |
| Support | The project directs questions and contributions to GitHub issues or pull requests and also mentions maintainer email and a Feishu group. | The project points users to the #k3s channel in Rancher Users Slack, the #flannel-users channel in Calico Users Slack, and GitHub issues for bugs. |
Plans
In their own words
Flannel
Flannel is a free network fabric for containers designed for Kubernetes. A small flanneld agent on each host allocates a subnet lease from a configured address space, then forwards packets between hosts using a selected backend. Documented choices include VXLAN, host-gw, WireGuard and UDP, with VXLAN recommended. WireGuard encapsulates and encrypts packets using the in-kernel WireGuard implementation. Network configuration and subnet allocations can be stored in the Kubernetes API or directly in etcd. The project documents Kubernetes and Docker deployments, with Linux and Windows build instructions. Flannel does not enforce network policies itself, though its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it. It runs as a privileged daemonset with access to the host network, so the security policy advises least privilege and keeping it updated. Security fixes are maintained for the latest release only, and the backend documentation says not to change a selected backend at runtime.