Most Kubernetes teams no longer run a single cluster on a single platform. A typical estate includes managed clusters in one or more public clouds, distributions running on-premises, and edge or sovereign environments, often with a different Container Network Interface (CNI) in each. The networking layer differs from place to place, but the questions operators ask during an incident are always the same: Which pods are talking to each other? Where are packets being dropped? Is it DNS? What actually happened on the wire?

Network observability has often been tied to a particular data plane. The richest eBPF-based tooling grew up alongside specific CNIs, and Hubble is a good example: it has historically been tightly coupled with Cilium. If your platform uses a different CNI, you have two choices. You can give up that depth of visibility, or you can re-architect your networking to get it. For a platform vendor with an established, production-proven data path, neither choice works.

Retina was built to remove that trade-off by decoupling observability from data plane. This post covers how Nutanix used Retina to add eBPF-powered network observability to the Nutanix Kubernetes Platform (NKP) and its OVN-Kubernetes-based Flow CNI.