KB: Kubernetes finding Networking (or CNI Plugin)

By default the kubelet looks into /etc/cni/net.d to discover the CNI plugins. This will be the same on every controlplane and worker nodes.

Default Behavior of kubelet and CNI Plugins:

  1. Location of CNI Configuration:

    • By default, the kubelet looks in /etc/cni/net.d for the CNI configuration files. This is where the CNI plugin's configuration files (like 10-weave.conf, 10-calico.conf, etc.) are stored.
    • If this directory contains valid configuration files, the kubelet uses the plugin(s) specified there.

  2. Location of CNI Plugin Executables:

    • The actual CNI binaries (executables) are typically stored in /opt/cni/bin by default. These binaries implement the networking logic (e.g., Calico, Weave Net, Flannel).

  3. Consistency Across Nodes:

    • The /etc/cni/net.d directory must have consistent CNI configurations across all control plane and worker nodes. This ensures that all nodes in the cluster handle pod networking in a consistent manner.
    • Similarly, the required binaries (in /opt/cni/bin) must also be installed on all nodes.

Important Points:

  • No Default CNI Plugin: Kubernetes does not come with a built-in CNI plugin. You must install one manually or use the one provided by your Kubernetes distribution (e.g., Calico, Flannel, Weave Net, etc.).
  • Environment-Dependent Paths:
    • While /etc/cni/net.d and /opt/cni/bin are the defaults, these paths can vary based on how Kubernetes was installed (e.g., kubeadm, a managed Kubernetes service like EKS/AKS/GKE, or a custom setup).
    • You can override these defaults using the --cni-conf-dir and --cni-bin-dir flags in the kubelet configuration.

Verification:

You can verify the CNI plugin configuration on a node:

  1. Check the kubelet logs for references to CNI:
    journalctl -u kubelet | grep CNI
  2. Look at the contents of /etc/cni/net.d:
    ls -l /etc/cni/net.d
  3. Ensure the CNI binaries exist in /opt/cni/bin:
    ls -l /opt/cni/bin

Conclusion:

Typical Kubernetes setup where the kubelet indeed looks for CNI configurations in /etc/cni/net.d, and this path must be consistent across all nodes. However, paths can differ in custom setups, so always check your cluster’s specific configuration.

Comments

Post a Comment

Popular posts from this blog

Electron Process Execution Failure with FSLogix

  Technical Note: Electron Process Execution Failure with FSLogix 1. Overview When running Electron-based applications in environments using FSLogix Profile or Office Containers , users may encounter issues where the Electron process fails to launch or execute properly . This behavior has been observed in Azure Virtual Desktop (AVD) , Windows Virtual Desktop (WVD) , and other environments where FSLogix filter drivers are active. 2. Symptoms Electron-based applications (e.g., desktop apps built on Electron, CLI wrappers) do not start , remain unresponsive, or terminate silently. No visible logs or error messages are generated by the application. Standard executables run correctly when placed outside of the FSLogix-controlled profile path (e.g., copying to C:\Temp allows execution). The issue is reproducible across all Electron apps in the FSLogix-managed profile. 3. Root Cause The issue is linked to FSLogix filter drivers ( frxdrv , frxdrvvt , frxccd ) interfe...
Read more

KB: Kube-proxy vs CNI Plugin

  kube-proxy is not considered a CNI plugin in Kubernetes or AKS (Azure Kubernetes Service). It serves a different purpose within the Kubernetes networking stack. Let me clarify the roles of kube-proxy and a CNI plugin kube-proxy: Role : kube-proxy manages network rules that allow communication between Kubernetes services and pods. It sets up the networking rules (e.g., iptables, IPVS, or eBPF) to enable service discovery and routing within the cluster. Key Responsibilities : Implements Kubernetes Service networking. Forwards traffic from a service's ClusterIP to the appropriate pod(s) backing the service. Handles load balancing for traffic directed to services. Scope : It operates at the service level, not the pod-to-pod network level. CNI Plugin: Role : A CNI plugin is responsible for setting up the pod network. It ensures that all pods across the cluster can communicate with each other and with the host network. Key Responsibilities : Assigns IP addresses to pods. Configures ...
Read more

KB: Azure ACA Container fails to start (no User Assigned or Delegated Managed Identity found for specified ClientId)

Image
When deploying secure workloads using Azure Container Apps (ACA) , teams often face confusion between User Assigned Managed Identities (UAMI) and App Registrations . While both entities are visible in Azure Active Directory and have similar identifiers (Application ID, Object ID), they serve very different purposes . This confusion can lead to authentication failures when accessing services like Azure App Configuration or Key Vault . A common issue occurs when a container app is configured with a managed identity, but the environment variables or role assignments mistakenly reference an App Registration instead, causing errors like: "No User Assigned or Delegated Managed Identity found for specified ClientId" This article breaks down the difference between UAMI and App Registrations, explains why this issue happens, and outlines the correct approach to resolve it. Symptoms Azure Container App fails to authenticate to Azure App Configuration or other services. Logs...
Read more