Who Assigns My Pod’s IP Address? 🤔 Mastering Cilium IPAM!

Aug 14, 2026

—

Hello! If you’ve been operating a Kubernetes cluster, you’ve probably wondered about this at some point.

“How do so many Pods get IP addresses instantly and communicate with each other?” 🤔 “Especially in large-scale clusters, who manages all these IP addresses, and how?”

At the heart of this magical process is the CNI (Container Network Interface), and today, we’re going to delve deep into the core of one of the hottest CNIs, Cilium, specifically its IPAM. If you read this article to the end, you’ll understand that Pod IP allocation is no longer magic, but a well-designed technology! 🚀

💡 IPAM, Let’s Start with the Name!

IPAM stands for Internet Protocol Address Management. As the name suggests, it means ‘Internet Protocol Address Management’.

To put it simply, it’s like a librarian (IPAM) giving an empty seat number (IP address) to students (Pods) entering a library. 📚 Just as students need to find a seat to start studying, Pods need to be assigned an IP address to begin communicating with other Pods.

In Cilium, IPAM is responsible for this core role: assigning unique IP addresses to all Pods within the cluster and reclaiming and managing them when they are no longer in use.

🌐 The Big Picture: IPAM’s Place in Cilium Networking

To properly understand IPAM, you need to know the overall context. Cilium is not just a tool for assigning IPs. It’s a solution that provides networking, security, and observability using powerful eBPF technology.

Pod Creation Request ➡️ The user executes the kubectl apply -f my-pod.yaml command.
Scheduling ➡️ The Kubernetes scheduler places the Pod on the most appropriate Node.
CNI Call ➡️ The Kubelet on that Node calls the Cilium CNI plugin, requesting, “Set up networking for this Pod!”
IPAM in Action ✨ ➡️ This is where Cilium IPAM comes in! It takes an available IP address from the pre-allocated IP range on the Node and assigns it to the Pod.
Network Setup Complete ➡️ Cilium uses the assigned IP and eBPF to configure the Pod’s network interface and apply necessary network policies (security rules).
Pod Running ✅ ➡️ Now the Pod has an IP address and is ready to communicate with other Pods in the cluster.

As such, IPAM plays a crucial role in initiating the Pod’s life (network).

🔧 How Does Cilium IPAM Work? (feat. IPAM Modes)

A key feature of Cilium IPAM is that it offers various ‘modes’ to enable IP management strategies optimized for different environments. Let’s look at the two most representative modes.

1. Cluster Pool (Default Mode)

This is the most commonly used default mode. It involves pre-defining a large IP range (cluster-pool-ipv4-cidr) for the entire cluster and assigning smaller IP ranges (PodCIDR) to each Node.

How it works:

The Cilium Operator monitors each Node in the cluster.
When a new Node joins the cluster, the Operator assigns a PodCIDR to that Node. For example, 10.0.1.0/24 to node-1, and 10.0.2.0/24 to node-2.
The Cilium agent deployed on the Node distributes one IP address from its assigned PodCIDR whenever a Pod is created.

This method isolates IP ranges per Node, eliminating the risk of IP conflicts. Since each Node allocates IPs independently, it’s very fast and efficient without central dependency. 👍

Below is an example of how IP ranges are assigned to actual Nodes via the CiliumNode resource.

# kubectl get ciliumnodes node-1 -o yaml
apiVersion: cilium.io/v2
kind: CiliumNode
metadata:
  name: node-1
spec:
  ipam:
    # You can see the IP range assigned to node-1.
    pod-cidrs:
    - 10.0.1.0/24
    # List of currently used IPs.
    pool:
      10.0.1.132:
        owner: app-pod-1
        resource: pod
      10.0.1.200:
        owner: app-pod-2
        resource: pod
status:
  ipam:
    # Number of available IPs
    available: 252
    # Number of IPs in use
    used: 2

2. Cloud Provider Integration Mode (AWS ENI, Azure IPAM, etc.)

In cloud environments like AWS, GCP, and Azure, there’s a smarter approach: directly leveraging the cloud provider’s networking services! For example, in an AWS environment, you can use the ipam: eni mode.

How it works (based on AWS ENI):

Cilium attaches an additional ENI (Elastic Network Interface) to the Node’s EC2 instance.
Each ENI can have multiple secondary Private IP addresses assigned to it.
When a Pod is created, Cilium directly assigns an IP address allocated to this ENI to the Pod, without a separate overlay network.

The biggest advantage of this method is that it fully utilizes cloud-native performance. There’s no overlay encapsulation process, which reduces network latency, and cloud features like VPC Flow Logs and Security Groups can be used directly at the Pod level. ☁️

❌ This is NOT IPAM! (Common Misconceptions)

To clarify IPAM’s role, it’s important to point out what IPAM is not.

Service Discovery ❌
IPAM assigns actual IPs like 10.0.1.132 to Pods. However, we usually access Pods using service names like my-service, not these IPs directly. The conversion of service names to IP addresses is the role of CoreDNS and Kubernetes Service. IPAM is like creating an address book, while service discovery is finding a name in that address book. 🗺️
Traffic Routing & Policy Enforcement ❌
If IPAM ‘grants’ an IP to a Pod, then actually ‘delivering’ data packets from Pod A to Pod B and ‘applying’ security policies like “A can communicate with B but not C” is handled by Cilium’s eBPF engine. IPAM’s role is up to assigning the address; actual traffic control is done by eBPF. 🚦
External Traffic Management (Ingress) ❌
Deciding which service external traffic should be directed to is the role of the Ingress Controller or Gateway API. IPAM focuses on managing IP addresses within the cluster. 🚪

✨ Conclusion: Well-Managed IPs Mean Cluster Stability!

So far, we’ve explored what Cilium IPAM is, how it works, and its role in the overall networking pipeline.

Assigning IP addresses to Pods may seem simple, but in a cloud-native environment where hundreds or thousands of Pods are dynamically created and destroyed, it’s a very complex and critical issue. Cilium IPAM solves this complexity and provides optimal IP management strategies for various environments, making stable, scalable, and high-performance Kubernetes networking possible. It is a core technology.

Now, as you watch your Pods receive IP addresses, why not remember the silent efforts of Cilium IPAM working behind the scenes? 😉