From 16881445687c9a445cb97ff6450f0719393fd10b Mon Sep 17 00:00:00 2001 From: Chen Tang Date: Tue, 30 Jun 2026 13:26:05 +0800 Subject: [PATCH] fix(multus): preserve delegate bytes when cniVersion injection fails CmdDel: do not clobber delegate Bytes when cniVersion injection fails. Assign to a temporary and only overwrite on success, so DEL keeps the original config instead of running with nil input, which would risk leaking the IP. Signed-off-by: Chen Tang --- pkg/multus/multus.go | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/pkg/multus/multus.go b/pkg/multus/multus.go index e851955ea..12f8e73c8 100644 --- a/pkg/multus/multus.go +++ b/pkg/multus/multus.go @@ -1086,10 +1086,14 @@ func CmdDel(args *skel.CmdArgs, exec invoke.Exec, kubeClient *k8s.ClientInfo) er // Inject cniVersion onto the raw bytes losslessly. Marshaling the // structured ConfList (types.NetConfList) here would strip // CNI-specific fields (e.g. calico's kubeconfig) and break DEL. - v.Bytes, err = types.InjectCNIVersionInConfList(v.Bytes, in.CNIVersion) - if err != nil { - // error happen but continue to delete - logging.Errorf("Multus: failed to inject cniVersion into delegate %q config: %v", v.Name, err) + updatedBytes, injectErr := types.InjectCNIVersionInConfList(v.Bytes, in.CNIVersion) + if injectErr != nil { + // error happen but continue to delete; keep the original bytes + // rather than clobbering them with nil, which would feed DEL + // worse input than before and risk leaking the IP. + logging.Errorf("Multus: failed to inject cniVersion into delegate %q config: %v", v.Name, injectErr) + } else { + v.Bytes = updatedBytes } } }