Documentation
¶
Overview ¶
Package plugin implements the Aether CNI plugin, which is invoked by the container runtime (e.g., containerd) during pod lifecycle transitions.
The plugin implements the Container Networking Interface (CNI) specification (v1.0.0) and is chained after other CNI plugins. It delegates actual networking setup to the Aether agent (running as a DaemonSet) via a gRPC client, enabling transparent traffic interception and service mesh integration.
The plugin supports these CNI operations:
- Add: Called when a pod is created. Collects pod metadata, resolves the container PID, and sends the pod info to the agent for registration.
- Del: Called when a pod is deleted. Sends the pod removal request to the agent.
- Check: Called to verify the plugin is functional (currently a no-op).
- GC and Status: Garbage collection and status reporting (currently no-ops).
The plugin extracts pod information from CNI arguments and the previous result from chained plugins, including pod IPs, network namespace, and Kubernetes metadata (pod name, namespace, container ID).
Index ¶
- Constants
- type AetherPlugin
- func (p *AetherPlugin) CmdAdd(args *skel.CmdArgs) error
- func (p *AetherPlugin) CmdCheck(args *skel.CmdArgs) error
- func (p *AetherPlugin) CmdDel(args *skel.CmdArgs) error
- func (p *AetherPlugin) CmdGC(args *skel.CmdArgs) error
- func (p *AetherPlugin) CmdStatus(args *skel.CmdArgs) error
- func (p *AetherPlugin) RunDetachedUnpin(args []string)
- type CNIClient
- func (c *CNIClient) AddPod(ctx context.Context, pod *cniv1.CNIPod) (*cniv1.AddPodResponse, error)
- func (c *CNIClient) CheckAgentConnection(ctx context.Context) error
- func (c *CNIClient) Close() error
- func (c *CNIClient) RemovePod(ctx context.Context, podName string, namespace string, containerId string) (*cniv1.RemovePodResponse, error)
- func (c *CNIClient) VerifyPodRegistered(ctx context.Context, pod *cniv1.CNIPod) error
Constants ¶
const NetnsUnpinSubcommand = "netns-unpin"
NetnsUnpinSubcommand is the hidden argv[1] under which the CNI binary re-executes itself as a short-lived detached unpinner.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AetherPlugin ¶
type AetherPlugin struct {
// contains filtered or unexported fields
}
AetherPlugin implements the CNI plugin interface for Aether service mesh integration. It is invoked by the container runtime during pod lifecycle transitions.
func NewAetherPlugin ¶
func NewAetherPlugin(logger *zap.Logger) *AetherPlugin
NewAetherPlugin creates a new AetherPlugin instance with the given logger.
func (*AetherPlugin) CmdAdd ¶
func (p *AetherPlugin) CmdAdd(args *skel.CmdArgs) error
CmdAdd handles the CNI Add operation, called when a pod is created. It parses the CNI configuration and Kubernetes arguments, extracts pod networking info, resolves the container PID, and sends the pod registration request to the agent. Returns the previous plugin's CNI result on success.
func (*AetherPlugin) CmdCheck ¶
func (p *AetherPlugin) CmdCheck(args *skel.CmdArgs) error
CmdCheck handles the CNI Check operation for plugin health verification. It validates the network namespace, interface, and pod registration with the agent.
func (*AetherPlugin) CmdDel ¶
func (p *AetherPlugin) CmdDel(args *skel.CmdArgs) error
CmdDel handles the CNI Del operation, called when a pod is deleted. It parses the CNI configuration and Kubernetes arguments, then sends the pod removal request to the agent for cleanup.
func (*AetherPlugin) CmdGC ¶
func (p *AetherPlugin) CmdGC(args *skel.CmdArgs) error
CmdGC handles the CNI GC (garbage collection) operation: it unpins netns pins whose container is no longer a valid attachment (orphans of failed DELs). Registry/xDS garbage collection is handled by the agent.
func (*AetherPlugin) CmdStatus ¶
func (p *AetherPlugin) CmdStatus(args *skel.CmdArgs) error
CmdStatus handles the CNI Status operation for plugin status reporting. It checks agent gRPC endpoint reachability.
func (*AetherPlugin) RunDetachedUnpin ¶
func (p *AetherPlugin) RunDetachedUnpin(args []string)
RunDetachedUnpin is the detached-unpinner entrypoint: argv = [target, delay].
type CNIClient ¶
type CNIClient struct {
// contains filtered or unexported fields
}
func NewCNIClient ¶
NewCNIClient creates a new CNI service client connected via Unix socket
func (*CNIClient) AddPod ¶
AddPod adds a pod to the registry with a timeout and retry logic for transient failures.
func (*CNIClient) CheckAgentConnection ¶
CheckAgentConnection verifies the gRPC connection to the agent is healthy by attempting to connect within the given context deadline.
func (*CNIClient) RemovePod ¶
func (c *CNIClient) RemovePod(ctx context.Context, podName string, namespace string, containerId string) (*cniv1.RemovePodResponse, error)
RemovePod removes a pod from the registry with a timeout. Del operations are not retried to avoid issues with duplicate deletions.
func (*CNIClient) VerifyPodRegistered ¶
VerifyPodRegistered verifies that a pod is still registered with the agent by re-sending an AddPod request. The agent's AddPod is idempotent — it will succeed if the pod is already registered. A non-SUCCESS result indicates the pod is no longer tracked by the agent.
Source Files