RKE2 ships with Canal (Calico + Flannel) as its default CNI—it works, but it’s built on iptables. At scale, iptables