CmdDel: do not clobber delegate Bytes when cniVersion injection
fails. Assign to a temporary and only overwrite on success, so DEL
keeps the original config instead of running with nil input, which
would risk leaking the IP.
Signed-off-by: Chen Tang <tangchen1234567@gmail.com>
A clusterNetwork loaded from a .conflist path was reconstructed via the
lossy cnitypes.PluginConf, dropping CNI-specific fields (calico's
kubeconfig/datastore_type/policy, etc). ADD survived by using the
complete CNINetworkConfigList, but DEL used the stripped Bytes, so
calico could not build its datastore client, never released the IP, and
leaked one address per teardown.
- LoadDelegateNetConfFromConfList: rebuild Bytes losslessly from the
libcni raw bytes (per-plugin, covering subdirectory-chain plugins)
instead of marshaling the lossy NetConfList; assign Bytes once after
deviceID/cni-args injection (fixes deviceID-without-cni-args drop)
- collapse the redundant CNINetworkConfigList field; conflistAdd now
uses Bytes uniformly, removing the dual source of truth and the TODO
- CmdDel: inject cniVersion onto raw Bytes via InjectCNIVersionInConfList
instead of re-marshaling the lossy ConfList (second stripping point)
- add regression tests for field preservation, subdirectory-chain
plugins, and cniVersion injection
Signed-off-by: Chen Tang <tangchen1234567@gmail.com>
Both pkg/multus and pkg/server tests used /tmp/foo.multus.conf as the
readiness indicator file. Since go test ./... runs packages in parallel,
pkg/multus AfterEach would delete the file while pkg/server STATUS/GC
tests were polling for it, causing intermittent failures.
Rename to /tmp/foo.multus.server-test.conf to avoid the collision.
overrideCNIConfigWithServerConfig returned the client config unchanged
whenever overrideConf was empty, bypassing the readinessindicatorfile
key-stripping logic even when ignoreReadinessIndicator=true. This
caused STATUS and GC handlers to poll for the readiness indicator file
for up to 45 s in tests that create the server with
ignoreReadinessIndicator=true and no server-side config override.
Also remove the now-unused sets import.
Signed-off-by: Fred Rolland <frolland@nvidia.com>
Replace full ResourceSlice object cache with a flat deviceInfoCacheKey→deviceInfo
index. Populate lazily per driver using combined spec.nodeName+spec.driver field
selectors derived from pod.Spec.NodeName, reducing API response size to a single
node's slices for one driver. Device lookup becomes O(1). Add ctx propagation to
GetPodResourceMap interface.
Signed-off-by: Fred Rolland <frolland@nvidia.com>
- If every allocation result for a claim is skipped (no slice match, missing
Multus deviceID/resourceName, etc.), log a warning and continue to the next
claim instead of returning an error, so kubelet/device-plugin entries stay
usable (hybrid legacy VF + broken or irrelevant DRA claims).
- getDeviceInfo: treat missing multus deviceID on a matched device as the same
skippable sentinel as “not in slice”, avoiding a misleading final error.
- Tests: expect nil error for unmapped claims; add case preserving pre-filled
resource map entries; keep VF+GPU success with empty GPU slice.
- k8sclient: stub kubelet ResourceClient in DRA failure test; logging: Warningf.
Signed-off-by: Fred Rolland <frolland@nvidia.com>
Migrate Dynamic Resource Allocation from kubelet PodResources / v1alpha2-style usage to the stable resource.k8s.io/v1 API (Kubernetes 1.34+).
- Add pkg/draclient: fetch ResourceClaims and ResourceSlices, build pod resource map from device attributes (k8s.cni.cncf.io/deviceID, k8s.cni.cncf.io/resourceName) and ExtendedResourceClaimStatus
- Wire GetPodResourceMap into k8sclient; remove DRA path from kubeletclient
- RBAC: resourceclaims, resourceclaims/status, resourceslices (get, list) on multus ClusterRole
- Docs: DRA / NAD usage; tests for draclient and k8sclient
Co-authored-by: Sebastian Sch <sebassch@gmail.com>
Signed-off-by: Fred Rolland <frolland@nvidia.com>
Add pprof profiling endpoints to the metrics server, gated behind
a new EnablePprof config field. When enabled, standard Go pprof
handlers are registered on the metrics port under /debug/pprof/.
This also improves the metrics server setup:
- Use dedicated http.ServeMux instead of DefaultServeMux
- Move mux/handler setup outside the retry loop
- Use http.Server with ReadHeaderTimeout for resource safety
- Add graceful shutdown on context cancellation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Benjamin Pickard <bpickard@redhat.com>
STATUS and GC are plugin-level commands with no pod context per the
CNI 1.1.0 spec. The thick plugin daemon incorrectly required
CNI_CONTAINERID, CNI_NETNS, and K8S_POD_NAME/K8S_POD_NAMESPACE for
these commands, causing failures when invoked by kubelet.
Signed-off-by: Jason Kary <jkary@redhat.com>
Validate the per-node kubeconfig when a current certificate is
available and fall back to the bootstrap kubeconfig only when the
per-node config is no longer trusted.
Also rebuild the derived per-node rest.Config from the reloaded
bootstrap config so TLS settings are preserved and refreshed
consistently.
Signed-off-by: Peng Liu <pliu@redhat.com>
Listing all pods across all namespaces during bootstrap is expensive
in large clusters and unnecessary since the result is discarded.
Use the lightweight /version endpoint to validate connectivity instead.
Signed-off-by: Peng Liu <pliu@redhat.com>
When a namespace uses a primary User-Defined Network (UDN) with a
device-plugin resource (e.g. SR-IOV), OVN-Kubernetes uses the last
device in the list for the primary interface while Multus assigns
earlier devices to cluster-default/secondary interfaces. The kubelet
and checkpoint paths build the list from map iteration, so order was
non-deterministic and the "last" device could differ between callers.
Sorting ensures both Multus and OVN-K8s see the same order so the
last device is consistently the one reserved for the primary UDN.
Signed-off-by: Yun Zhou <yunz@nvidia.com>
The trivy-action@0.29.0 was trying to install Trivy v0.57.1 which
no longer exists in the GitHub releases. This was causing all PR
builds to fail on the "Image thick plugin" job. Update to v0.35.0
which properly installs the latest Trivy version.
Assisted by Claude Sonnet 4.5
Signed-off-by: Benjamin Pickard <bpickard@redhat.com>
Fix thin auto-config generation to select 00-multus.conflist for
all CNI versions >= 1.0.0 (not only exact 1.0.0)
Signed-off-by: Tim Rozet <trozet@nvidia.com>
