Kubernetes Pod CIDR: Planning Your Cluster Address Space
Kubernetes requires three non-overlapping CIDR blocks: one for nodes, one for pods, and one for services. Choosing these correctly at cluster creation time prevents painful re-addressing later.
Kubernetes networking involves three distinct CIDR blocks that must not overlap with each other or with your existing infrastructure. Getting them wrong at cluster creation is expensive to fix — Kubernetes does not support renumbering the pod or service CIDR after the fact without rebuilding the cluster. See the Kubernetes pod CIDR guide for a deep dive into the design principles.
The Three Required CIDRs
- Node CIDR — the subnet your cluster nodes (VMs) live on. These are regular IP addresses from your infrastructure network.
- Pod CIDR (
--pod-network-cidr) — the range from which individual pod IP addresses are allocated. Each node gets a slice of this range. - Service CIDR (
--service-cluster-ip-range) — virtual IPs for Kubernetes Services. These addresses only exist inside the cluster and are never routed externally.
Sizing the Pod CIDR
The pod CIDR needs to accommodate every pod your cluster will ever run simultaneously — across all nodes. A common formula: multiply the maximum number of nodes by the maximum pods per node, then add significant headroom. If you plan for 50 nodes with 110 pods each, that is 5,500 pods. A /16 (65,534 addresses) gives ample headroom. Most CNI plugins carve a fixed slice per node from the pod CIDR — Flannel defaults to /24 per node, giving each node 254 pod addresses.
CNI Plugin Defaults
- Flannel: pod CIDR default
10.244.0.0/16,/24per node - Calico: pod CIDR default
192.168.0.0/16, configurable block size per node - Cilium: pod CIDR default
10.0.0.0/8, configurable per-node block - AWS VPC CNI: uses the VPC subnet's address space directly — pods get real VPC IPs
The AWS VPC CNI design eliminates NAT between pods and VPC resources but requires more IP addresses. A /24 node subnet gives only 251 usable IPs (accounting for AWS reservations), limiting density. Many EKS clusters need /22 or larger node subnets to accommodate both node and pod addresses.
Service CIDR Sizing
Services are virtual — they only exist as iptables or eBPF rules inside the cluster. A /16 service CIDR (65,534 IPs) is almost always more than enough. The default in kubeadm is 10.96.0.0/12. The important constraint is that this range must not overlap with your pod CIDR, node network, or any externally routable address space.
Avoiding Conflicts with Existing Infrastructure
Before creating a cluster, check your existing address space: corporate WAN, VPN ranges, cloud VPC CIDRs, and any Docker or container network ranges on the nodes. Use the CIDR calculator to verify that your chosen pod and service CIDRs do not overlap with anything already in use. A conflict with a VPN range will silently break outbound traffic from pods to corporate systems — difficult to diagnose after the fact.