Terway

What Terway is

Terway is a CNI plugin for Alibaba Cloud Kubernetes (ACK), built on Alibaba Cloud ENI technology. It gives each Pod a separate network stack and IP address. Pods on the same ECS instance communicate directly, while traffic between ECS instances travels through VPC ENIs without VxLAN encapsulation. ENI mode allocates interfaces to Pods to support resource use and network performance; trunking can provide independent ENIs for flexible security-group and switch configurations. Node pools can be set up for exclusive ENI use. Terway supports Kubernetes NetworkPolicy, traditional security groups, and dual-stack IPv4 and IPv6. It also uses eBPF for protocol-stack acceleration, which the project describes as supporting low latency and high throughput. The open-source plan is free. Terway supports Linux and is listed for Kubernetes ACK, Alibaba Cloud VPC/ENI, Alibaba Cloud Linux 3/4, ContainerOS, and Ubuntu. In self-hosted clusters, trunking is unavailable. The project marks VPC Network Mode and Exclusive ENI Mode as deprecated.

Who it suits

Terway suits teams running Kubernetes ACK on Alibaba Cloud that need Pod networking with ENI-based controls. Teams using self-hosted clusters should note that trunking is unavailable there.

Limits

Terway is free. Trunking is unavailable in self-hosted clusters, and VPC Network Mode and Exclusive ENI Mode are marked deprecated.

Getting started

1. Open the Terway project on GitHub.
2. Select a supported environment: Kubernetes ACK, Alibaba Cloud VPC/ENI, Alibaba Cloud Linux 3/4, ContainerOS, or Ubuntu.
3. Deploy Terway in a Linux Kubernetes environment.
4. For self-hosted clusters, plan without Trunking.
5. Consult the project’s SECURITY.md for vulnerability reporting details.

Verdict

Terway provides ENI-based Pod networking and network access controls for Alibaba Cloud Kubernetes. Its self-hosted trunking limitation and deprecated modes may affect deployment choices.