IPAM and Pod CIDR Allocation
How does every Pod in the cluster end up with a unique IP and no clashes? The cluster starts from one large pod CIDR, and the controller-manager, whenever it is started with --allocate-node-cidrs, carves a smaller non-overlapping slice out of it for each Node into node.spec.podCIDR. A CNI IPAM that uses that field then hands out addresses only from its own Node slice, which keeps every Pod IP unique cluster-wide and keeps routing down to a single route per Node.
Play the animation 4 steps, animated, best on a wide screen
IPAM and Pod CIDR Allocation, step by step
-
The cluster pod CIDR is set on the controller-manager with the --cluster-cidr flag. It is the single pool every Node slice is carved from, and on its own it belongs to no Node yet.
Play from step 1 -
With --allocate-node-cidrs set, the controller-manager carves a smaller, non-overlapping block out of the pool for every Node and writes it into node.spec.podCIDR. The block size comes from --node-cidr-mask-size, /24 by default, so Node-1 owns 10.244.1.0/24, Node-2 owns 10.244.2.0/24 and Node-3 owns 10.244.3.0/24.
Play from step 2 -
When a Pod is scheduled to Node-1, a CNI IPAM that uses the Node podCIDR draws its address strictly out of that slice, 10.244.1.0/24, so the Pod gets 10.244.1.5. Allocation never reaches outside the block a Node owns, which is exactly what stops two Nodes from colliding.
Play from step 3 -
Every other Node assigns the same way, out of its own slice. A Pod scheduled to Node-2 gets 10.244.2.8 from 10.244.2.0/24, a different /24 that can never overlap the addresses on Node-1. Node-3 holds 10.244.3.0/24 with no Pod scheduled on it yet, because a block is carved at Node registration. So every Pod IP is unique across the whole cluster, which is what lets any Pod be reached directly while routing only has to track which Node owns which /24.
Play from step 4