Support meta-CNI coexistence and ipvtap devices - #547
Open
Patrick W. Healy (phealy) wants to merge 2 commits into
Open
Support meta-CNI coexistence and ipvtap devices#547Patrick W. Healy (phealy) wants to merge 2 commits into
Patrick W. Healy (phealy) wants to merge 2 commits into
Conversation
Add an opt-in node configuration that permits the unbounded CNI conflist to coexist with meta-CNI configurations such as Multus. Also grant nspawn containers access to ipvtap character devices. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e33ad9aa-83f5-4541-bb5f-349185fdc589
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request extends the unbounded-net node agent and agent nspawn service configuration to better support meta-CNI deployments (e.g., Multus) while keeping the existing single-CNI safety behavior as the default, and to permit ipvtap character devices via systemd device cgroup rules.
Changes:
- Add an opt-in node setting / CLI flag (
allowCNIConfigCoexistence/--allow-cni-config-coexistence) to allow writing the unbounded CNI conflist alongside other existing conflists. - Update the nspawn systemd service drop-in template (and goldens/tests/docs) to always include
DeviceAllow=char-ipvtap rwm. - Update manifests and documentation to surface the new runtime setting/flag.
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/agent/phases/rootfs/assets/service-override.conf | Always allow ipvtap character devices in the generated systemd drop-in. |
| pkg/agent/phases/rootfs/nspawn_render_test.go | Adjust rendering assertions to account for the new DeviceAllow=char-ipvtap rwm line. |
| pkg/agent/phases/rootfs/testdata/service-override-kube1.conf.golden | Update golden snapshot to include the ipvtap DeviceAllow entry. |
| pkg/agent/phases/rootfs/testdata/service-override-kube2.conf.golden | Update golden snapshot to include the ipvtap DeviceAllow entry. |
| pkg/agent/phases/rootfs/testdata/render/cpu-only.service-override.conf.golden | Update rendered golden output to include the ipvtap DeviceAllow entry. |
| pkg/agent/phases/rootfs/testdata/render/nvidia-all-helpers.service-override.conf.golden | Update rendered golden output to include the ipvtap DeviceAllow entry. |
| pkg/agent/phases/rootfs/testdata/render/nvidia-gb300-rack-full.service-override.conf.golden | Update rendered golden output to include the ipvtap DeviceAllow entry. |
| internal/net/config/runtime_config.go | Add allowCNIConfigCoexistence to node runtime config (as an optional *bool). |
| cmd/unbounded-net-node/main.go | Add CLI flag and runtime-config plumbing for CNI config coexistence. |
| cmd/unbounded-net-node/main_config_test.go | Add tests for runtime-config behavior and flag precedence for the new setting. |
| cmd/unbounded-net-node/bootstrap_helpers.go | Gate the existing “foreign conflist” safety check behind the new opt-in flag. |
| cmd/unbounded-net-node/bootstrap_helpers_test.go | Add coverage validating coexistence mode allows writing alongside an existing conflist. |
| deploy/net/01-configmap.yaml.tmpl | Render the new allowCNIConfigCoexistence field into the node runtime config. |
| docs/net/configuration.md | Document the new --allow-cni-config-coexistence flag. |
| docs/content/reference/networking/configuration.md | Document the new node runtime config field and flag. |
| docs/content/reference/agent/nspawn.md | Document the added ipvtap DeviceAllow entry in the service override. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add char-ipvtap to the assembled HostDeviceGroupSpecifiers list instead of hard-coding a DeviceAllow line in the service override template. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e33ad9aa-83f5-4541-bb5f-349185fdc589
Comment on lines
320
to
331
| func TestServiceOverride_NoHostDevicesNoDeviceAllow(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| var buf bytes.Buffer | ||
| require.NoError(t, nspawnTemplates.ExecuteTemplate(&buf, "service-override.conf", nspawnTemplateData{ | ||
| MachineName: "kube1", | ||
| BPFFSMountPath: goalstates.BPFFSMountPath("kube1"), | ||
| // No HostDevicePaths and no GPU devices. | ||
| })) | ||
|
|
||
| // With no devices the drop-in must not contain any DeviceAllow lines, | ||
| // which is what keeps the existing golden snapshots unchanged. | ||
| require.NotContains(t, buf.String(), "DeviceAllow=") | ||
| } |
Patrick W. Healy (phealy)
marked this pull request as ready for review
July 27, 2026 11:53
hbc (bcho)
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
allowCNIConfigCoexistencenode setting and--allow-cni-config-coexistenceflag for Multus and other meta-CNI deploymentsDeviceAllow=char-ipvtap rwmto generated nspawn service overridesValidation
go test ./cmd/unbounded-net-node ./internal/net/config ./pkg/agent/phases/rootfsmake lintmake net-manifests