Side by side
Amazon VPC CNI vs Submariner
Both stand on container networking software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Choose Amazon VPC CNI for Kubernetes clusters on AWS that need pod networking through VPC addresses and ENIs. Its documented NetworkPolicy and EKS integrations may suit those environments. Look elsewhere if you require dual-stack networking or need pod security groups on non-Nitro instances.
Visit Amazon VPC CNISubmariner provides a free, self-hosted way to link Kubernetes services across clusters, with several tunnel choices and service discovery. Teams should account for network administration and the experimental status of external connectivity and Load Balancer mode.
Visit SubmarinerThe facts
| Amazon VPC CNI | Submariner | |
|---|---|---|
| Free plan | Not published | Yes |
| Open source | Not published | Not published |
| Runs on | Linux, Self-hosted, Windows | Self-hosted |
| Lowest paid plan | Not published | Not published |
| Plans published | None | None |
| Maker | Not published | Not published |
| Website | github.com | submariner.io |
| On container networking software | #24 of 28 | #20 of 28 |
Amazon VPC CNI: what it does well
- Open-source Kubernetes networking plugin for AWS clusters.
- Assigns private IPv4 or IPv6 addresses from the VPC.
- Warm pools can hold ENIs, IP addresses, or delegated prefixes.
- NetworkPolicy support is available in versions 1.14 and later.
- Documents YAML manifest and AWS Helm chart installation.
What to know first
- Pod IP capacity depends on the instance type's network capacity.
- IPv6 requires prefix delegation, and dual-stack mode is unsupported.
- Pod security groups are limited to Nitro-based instances.
- The manifest runs two containers in privileged mode.
Submariner: what it does well
- Cross-cluster Layer 3 connectivity
- Lighthouse provides multi-cluster DNS discovery
- Supports IPsec, WireGuard, and VXLAN
- Active/passive gateway high availability
- Open source and self-hosted
What to know first
- Requires administrative firewall configuration
- External endpoint access is experimental
- Load Balancer mode is experimental
- Overlapping CIDRs need optional Globalnet
Alternatives to Amazon VPC CNI Alternatives to Submariner The whole list