Freedom251 › Container Networking Software
Cello CNI
What Cello CNI is
Cello CNI is a Kubernetes networking plugin for connecting cluster workloads within a Volcengine VPC. It builds Pod networks with secondary ENIs, offering shared ENI and ENI multi-IP modes; both support communication between Pods and between Pods and nodes. Cello integrates Cilium instead of kube-proxy and supports ClusterIP, NodePort, and LoadBalancer services. Its Cilium components support NetworkPolicy through eBPF programs on a Pod’s primary device. A Kubernetes device plugin reports available network resources so the scheduler can place Pods on nodes with capacity. Pod capacity depends on the ECS instance type and ENI quotas, and exclusive ENI mode supports fewer Pods than shared ENI mode. Cello provides cluster-wide and node-specific settings, with selected changes available at runtime without restarting its Pods. It is free under the Apache 2.0 license. Deployment requires Volcengine ECS, Kubernetes, and Helm 3.0 or later; the project recommends kubeadm and specifies kernel 4.19 or later for ECS. It notes testing on veLinux 1.0 with kernel 5.10.
Who it suits
Cello suits teams running Kubernetes on Volcengine ECS that need VPC-based Pod networking and network policies. It is relevant to operators who can provide the required IAM permissions and manage the stated ECS, kernel, and Helm requirements.
What it does well
- Supports shared ENI and ENI multi-IP networking modes.
- Supports Pod-to-Pod and Pod-to-Node communication.
- Supports ClusterIP, NodePort, and LoadBalancer services.
- Selected settings can change without restarting Cello Pods.
- Free under the Apache 2.0 license.
What to know first
- Requires Volcengine ECS and Kubernetes.
- Requires Helm 3.0 or later.
- Pod capacity depends on ECS type and ENI quotas.
- Exclusive ENI mode supports fewer Pods than shared ENI mode.
Limits
Pod capacity depends on ECS instance type and ENI quotas. Exclusive ENI mode supports fewer Pods than shared ENI mode.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Cello CNI | Open source under Apache 2.0 · Requires Volcengine ECS and Kubernetes · Helm 3.0 required | Free |
As github.com lists them, read 7 Oct 2026. The maker's own page has the final word.
Getting started
- Prepare Volcengine ECS instances with kernel 4.19 or later.
- Install Kubernetes; the README recommends kubeadm.
- Grant Volcengine IAM permissions for the required ECS and VPC operations.
- Configure Cello for the cluster and its nodes.
- Install Cello with Helm 3.0 or later.
Verdict
Cello CNI combines VPC-based Pod networking with Cilium services and NetworkPolicy support. Check ECS capacity, ENI quotas, kernel requirements, and IAM access before deployment.
Questions
How much does Cello CNI cost?
The listed plan is free.
What does Cello CNI run on?
It requires Kubernetes on Volcengine ECS. The deployment requirements specify Linux kernel 4.19 or later, and the project notes testing on veLinux 1.0 with kernel 5.10.
Which Kubernetes services does it support?
Cello integrates Cilium in place of kube-proxy and supports ClusterIP, NodePort, and LoadBalancer services.
Does Cello CNI support network policies?
Yes. Its Cilium components support NetworkPolicy using eBPF programs on a Pod’s primary device.
What license does Cello CNI use?
It is distributed under the Apache 2.0 license.
What is required to install it?
Cello must be configured and installed with Helm 3.0 or later. The README recommends kubeadm for Kubernetes installation and Volcengine IAM permissions are needed for ECS and VPC API operations.
Facts from Cello CNI's own pages
- Cloud integration
- Cello requires Volcengine IAM permissions to call ECS and VPC APIs for instance, ENI, IP address, and subnet operations. · github.com, 7 Oct 2026
- Communication
- Both network modes support Pod-to-Pod and Pod-to-Node communication. · github.com, 7 Oct 2026
- Configuration
- Cello supports cluster-wide and node-specific configuration, and selected settings can be changed at runtime without restarting Cello Pods. · github.com, 7 Oct 2026
- Deployment requirements
- The README specifies Volcengine ECS with kernel 4.19 or later, notes testing on veLinux 1.0 with kernel 5.10, and recommends kubeadm for Kubernetes installation. · github.com, 7 Oct 2026
- Installation
- The README instructs users to configure Cello and install it with Helm 3.0 or later. · github.com, 7 Oct 2026
- License
- Cello is distributed under the Apache 2.0 license. · github.com, 7 Oct 2026
- Network policy
- The project says its Cilium components support NetworkPolicy and use eBPF programs on a Pod's primary device. · github.com, 7 Oct 2026
- Pod networking
- Cello uses secondary ENIs to build Pod networks and supports shared ENI and ENI multi-IP modes. · github.com, 7 Oct 2026
- Purpose
- Cello is a Kubernetes CNI plugin based on the Volcengine VPC network that lets cluster workloads communicate within the VPC. · github.com, 7 Oct 2026
- Resource limit
- Pod capacity depends on the ECS instance type and ENI quotas; exclusive ENI mode supports fewer Pods than shared ENI mode. · github.com, 7 Oct 2026
- Scheduling
- Cello reports available network resources through a Kubernetes device plugin so the scheduler can place Pods on nodes with resources. · github.com, 7 Oct 2026
- Security reporting
- The security policy asks reporters to contact ByteDance's security team or [email protected] and not file public GitHub issues for vulnerabilities. · github.com, 7 Oct 2026
- Services
- Cello integrates Cilium in place of kube-proxy and supports ClusterIP, NodePort, and LoadBalancer services. · github.com, 7 Oct 2026
- Support
- The project directs questions and contributions to GitHub issues or pull requests and also mentions maintainer email and a Feishu group. · github.com, 7 Oct 2026
Where Cello CNI stands on Freedom251
- Container Networking Software#5 of 28