Documentation
¶
Overview ¶
Package cni wraps the bridge+host-local CNI plugin for containerd sandboxes. Our topology is a single bridge plugin with host-local IPAM embedded in its config, so ADD/DEL invoke that one plugin over the standard CNI exec protocol (CNI_* env vars + the plugin netconf on stdin) rather than chaining a plugin list. DEL is idempotent by the CNI contract (DEL on a missing allocation is a no-op); ADD is NOT idempotent at this layer — callers must not re-ADD the same container into the same netns or host-local allocates a second IP.
Index ¶
- Constants
- func BridgeMTU() int
- func EnsureBridgeConflist(path string, opts ConflistOptions) error
- func RenderBridgeConflist(opts ConflistOptions) ([]byte, error)
- func UplinkMTU() int
- type Config
- type ConflistOptions
- type ExecRunner
- type FakeRunner
- func (f *FakeRunner) Add(ctx context.Context, netnsPath, containerID string) (Result, error)
- func (f *FakeRunner) Adds() []call
- func (f *FakeRunner) Del(ctx context.Context, netnsPath, containerID string) error
- func (f *FakeRunner) Dels() []call
- func (f *FakeRunner) SetAddError(err error)
- func (f *FakeRunner) SetDelError(err error)
- type Result
- type Runner
Constants ¶
const ( // DefaultBridgeMTU is the fallback bridge veth MTU when the host uplink MTU // cannot be determined. Docker-parity default. DefaultBridgeMTU = 1500 )
const DefaultBridgeSubnet = "10.88.0.0/16"
DefaultBridgeSubnet is the host-local IPAM subnet for the aerolvm0 bridge. Shared so the netrules FORWARD-accept rules target the same CIDR the conflist hands out.
Variables ¶
This section is empty.
Functions ¶
func BridgeMTU ¶
func BridgeMTU() int
BridgeMTU is the docker-parity default MTU. Callers that want uplink parity use UplinkMTU() and fall back to this.
func EnsureBridgeConflist ¶ added in v0.7.2
func EnsureBridgeConflist(path string, opts ConflistOptions) error
EnsureBridgeConflist writes a bridge+host-local CNI conflist to path if it is absent, so the containerd netns pool has a network to realize. This is the §4 owner for items dockerd's libnetwork used to provide: the bridge, IPAM, and outbound NAT (`ipMasq: true`). It never overwrites an operator-provided conflist. Returns the effective path.
NOTE: the generated JSON is validated offline (schema + round-trip), but the plugins that consume it run only on a live host with /opt/cni/bin populated — exercised by the containerd integration suite, not `make test`.
func RenderBridgeConflist ¶ added in v0.7.2
func RenderBridgeConflist(opts ConflistOptions) ([]byte, error)
RenderBridgeConflist produces the conflist JSON. Kept separate from the file write so it is unit-testable without touching disk.
func UplinkMTU ¶ added in v0.7.2
func UplinkMTU() int
UplinkMTU returns the MTU of the host's default-route interface, or 0 when it cannot be determined (non-linux, or no default route). Sizing the bridge/veth to the uplink avoids two failure modes the hardcoded 1500 caused: on a jumbo-frame uplink (AWS ENA is 9001) a 1500 bridge caps throughput, and on a sub-1500 uplink (overlay/VPN/GRE) a 1500 bridge blackholes egress via PMTUD.
Types ¶
type Config ¶
type Config struct {
// PluginDir is typically /opt/cni/bin.
PluginDir string
// ConfPath is a .conflist or .conf consumed by the plugin.
ConfPath string
// IfName is the interface created inside the netns; defaults to eth0.
IfName string
}
Config locates plugin binaries and the bridge conf on disk.
type ConflistOptions ¶ added in v0.7.2
type ConflistOptions struct {
Name string // network name, e.g. "aerolvm"
Bridge string // host bridge interface, e.g. "aerolvm0"
Subnet string // host-local IPAM subnet, e.g. "10.88.0.0/16"
Gateway string // optional explicit gateway; host-local derives .1 if empty
MTU int // bridge/veth MTU; <=0 falls back to DefaultBridgeMTU
}
ConflistOptions parameterizes the generated bridge+host-local conflist.
type ExecRunner ¶
type ExecRunner struct {
// contains filtered or unexported fields
}
ExecRunner shells out to the CNI plugin binary referenced by ConfPath's `type`, speaking the CNI exec protocol.
func NewExecRunner ¶
func NewExecRunner(cfg Config) (*ExecRunner, error)
type FakeRunner ¶
type FakeRunner struct {
// contains filtered or unexported fields
}
FakeRunner is an in-memory CNI backend for unit tests.
func NewFakeRunner ¶
func NewFakeRunner() *FakeRunner
func (*FakeRunner) Adds ¶
func (f *FakeRunner) Adds() []call
func (*FakeRunner) Del ¶
func (f *FakeRunner) Del(ctx context.Context, netnsPath, containerID string) error
func (*FakeRunner) Dels ¶
func (f *FakeRunner) Dels() []call
func (*FakeRunner) SetAddError ¶
func (f *FakeRunner) SetAddError(err error)
func (*FakeRunner) SetDelError ¶
func (f *FakeRunner) SetDelError(err error)
Source Files