Performance Evaluation of Container Network Interfaces in OpenShift for Industrial Real-Time Workloads

Abstract

Operational Technology (OT) workloads such as controllers are increasingly containerized (e.g., Soft controllers) and deployed on Kubernetes distributions, with Red Hat Open-Shift being widely adopted in industrial deployments. In such environments the Container Network Interface (CNI) plugin is critical because it directly determines latency, jitter, throughput and the ability to enforce traffic prioritization, all central to low-latency and predictable real-time control. This study presents an experimental performance evaluation of three most common CNIs available for OpenShift: the default OVN-Kubernetes, Calico and Cilium. We analyze their data-plane architectures, identify the limitations of the default fq_codel queueing discipline for real-time traffic, and propose a priority-aware traffic queuing configuration that improves real-time performance across OVN-Kubernetes, Calico, and Cilium. Using a three-node testbed driven by Flent and iperf3 we evaluate three significant communication deployment patterns same machine, different machine and external mixed background load and network-policy stress. Results show that Cilium achieves the lowest intra-cluster latency thanks to its eBPF-based qdisc bypass, Calico and Cilium perform similarly on external traffic, and OVN-Kubernetes shows higher latency and jitter due to its richer logical pipeline but, once reconfigured with a priority-aware qdisc and DSCP inheritance, can deliver sub-millisecond high-priority latency for same-node flows under a full $1 \text{Gb} / \mathrm{s}$ background load in the evaluated setup.