Cello CNI
Cello CNI is a free Kubernetes networking plugin that connects cluster workloads within a Volcengine VPC.
What Cello CNI is
Cello CNI is a free Kubernetes networking plugin that connects cluster workloads within a Volcengine VPC. It builds Pod networks using secondary ENIs, with shared ENI and ENI multi-IP modes; both allow Pod-to-Pod and Pod-to-Node communication. Cello integrates Cilium instead of kube-proxy and supports ClusterIP, NodePort, and LoadBalancer services. Its Cilium components support NetworkPolicy using eBPF programs on a Pod's primary device. A Kubernetes device plugin reports available network resources to help the scheduler place Pods on nodes with capacity. Pod capacity depends on ECS instance type and ENI quotas, and exclusive ENI mode supports fewer Pods than shared ENI mode. Cello supports cluster-wide and node-specific configuration, with selected settings changeable at runtime without restarting Cello Pods. It is distributed under the Apache 2.0 license. Deployment requires Volcengine ECS, Kubernetes, and Helm 3.0 or later, while ECS requires kernel 4.19 or later. The README recommends kubeadm for Kubernetes installation and notes testing on veLinux 1.0 with kernel 5.10. Cello also needs Volcengine IAM permissions to use ECS and VPC APIs for instance, ENI, IP address, and subnet operations.
Good
- Free and licensed under Apache 2.0.
- Supports Pod-to-Pod and Pod-to-Node communication.
- Supports NetworkPolicy through Cilium components.
- Selected settings can change without restarting Cello Pods.
Watch out
- Requires Volcengine ECS and Kubernetes.
- Requires Helm 3.0 or later.
- Needs Volcengine IAM permissions for ECS and VPC APIs.
- Pod capacity depends on instance type and ENI quotas.
Who it suits
Cello CNI suits teams running Kubernetes workloads on Volcengine ECS that need Pod networking within a VPC. It is intended for environments able to meet its kernel, Helm, and cloud IAM requirements.
Verdict
Cello CNI provides VPC-based Pod networking with service and NetworkPolicy support. Its fit depends on Volcengine ECS, Kubernetes, IAM access, and available ENI capacity.
Plans and prices
From Cello CNI's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Cello CNI | Free | Open source under Apache 2.0 · Requires Volcengine ECS and Kubernetes · Helm 3.0 required |
The facts
Each one read from Cello CNI's own pages, with the date it was checked.
What it does
- Cloud integration
- Cello requires Volcengine IAM permissions to call ECS and VPC APIs for instance, ENI, IP address, and subnet operations.checked 7 Oct 2026
- Communication
- Both network modes support Pod-to-Pod and Pod-to-Node communication.checked 7 Oct 2026
- Configuration
- Cello supports cluster-wide and node-specific configuration, and selected settings can be changed at runtime without restarting Cello Pods.checked 7 Oct 2026
- Deployment requirements
- The README specifies Volcengine ECS with kernel 4.19 or later, notes testing on veLinux 1.0 with kernel 5.10, and recommends kubeadm for Kubernetes installation.checked 7 Oct 2026
- Installation
- The README instructs users to configure Cello and install it with Helm 3.0 or later.checked 7 Oct 2026
- License
- Cello is distributed under the Apache 2.0 license.checked 7 Oct 2026
- Network policy
- The project says its Cilium components support NetworkPolicy and use eBPF programs on a Pod's primary device.checked 7 Oct 2026
- Pod networking
- Cello uses secondary ENIs to build Pod networks and supports shared ENI and ENI multi-IP modes.checked 7 Oct 2026
- Purpose
- Cello is a Kubernetes CNI plugin based on the Volcengine VPC network that lets cluster workloads communicate within the VPC.checked 7 Oct 2026
- Resource limit
- Pod capacity depends on the ECS instance type and ENI quotas; exclusive ENI mode supports fewer Pods than shared ENI mode.checked 7 Oct 2026
- Scheduling
- Cello reports available network resources through a Kubernetes device plugin so the scheduler can place Pods on nodes with resources.checked 7 Oct 2026
- Security reporting
- The security policy asks reporters to contact ByteDance's security team or [email protected] and not file public GitHub issues for vulnerabilities.checked 7 Oct 2026
- Services
- Cello integrates Cilium in place of kube-proxy and supports ClusterIP, NodePort, and LoadBalancer services.checked 7 Oct 2026
- Support
- The project directs questions and contributions to GitHub issues or pull requests and also mentions maintainer email and a Feishu group.checked 7 Oct 2026
Alternatives to Cello CNI
- 1
Antrea
Free planOpen sourceAPILinuxSelf-hostedWindows7.2Free plan - 2
Network Service Mesh
Free planOpen sourceAPILinuxSelf-hosted7.0Free plan - 3
Aviatrix Kubernetes Firewall
WebSelf-hosted6.2 - 4
kube-network-policies
Free planLinuxSelf-hosted6.2Free plan - 5
Calico Open Source
Free planLinuxSelf-hostedWindows6.1Free plan - 6
Cilium
Free planLinuxSelf-hosted6.0Free plan