Dataplane V2 turns Kubernetes intent into eBPF programs

GKE deploys anetd on each node. It interprets Services and NetworkPolicies, then programs eBPF for routing, load balancing and enforcement.

1Watch objectsanetd observes Services, Endpoints and policies.

2Compile intentRules are translated into efficient data-plane state.

3Program kerneleBPF handles packets without long iptables chains.

4Route and enforceService translation and policy occur in the node kernel.

5Export evidenceLogging can report policy decisions and dropped traffic.

Dataplane V2 is implemented with Cilium, but GKE owns the supported configuration surface.

Dataplane V2 turns Kubernetes intent into eBPF programs

Dataplane V2 is easiest to understand by separating the Kubernetes contract from the Google Cloud implementation. Dataplane V2 is GKE's Cilium-based networking dataplane. The anetd DaemonSet programs eBPF for routing, Service load balancing and Kubernetes NetworkPolicy. The Kubernetes objects stay familiar, but GKE supplies controllers, infrastructure and safe defaults around them. This is why a team can move from an on-premises cluster without rewriting every workload, while still needing to redesign networking, identity and operational ownership for the cloud environment.

A useful inspection step is `kubectl -n kube-system get ds anetd`. Read the output as evidence, not as a ritual: first confirm the desired object exists, then look at status conditions, events and the Google Cloud resource it represents. In production, capture the expected result in a runbook or automated check so an operator can distinguish slow reconciliation from a configuration error.

Production gotcha: Do not install arbitrary custom eBPF programs on Dataplane V2 nodes; they can interfere with GKE's essential programs and are unsupported. The safe habit is to verify quotas, regional availability and feature support against current Google Cloud documentation before rollout. NetworkPolicy uses this enforcement engine on the next slide.