I'm not sure what the solution is but as more and more apps start to use CNI, I'm seeing them fight over the /etc/cni/net.d directory. For example, RH CoreOS pre-installs podman, which includes its own CNI in /etc/cni/net.d.
If you then install kubernetes on the same system, you'd typically want to install a kubernetes focussed CNI (such as Calico or Flannel) but:
- In the window before the k8s CNI is installed, podman's CNI will get used for early-scheduled pods (ugh!)
- After the k8s CNI is installed then podman will try to use it, which is generally unexpected and likely broken.
CRIO also installs its own CNI by default.
In general the problems this causes are strange and confusing for an end user who didn't even know they had podman installed. They just see broken networking with some pods getting IPs from a different IP range.
I think it'd be good if the CNI spec could address this somehow. In general, I think it's more common to want a different CNI for each app that's installed rather than to share.
I suppose one option would be to add something to the netconf that says "this config should only be used by kubernetes/podman/whatever". Then the bootstrap CNIs installed by those apps could include such a stanza.
I'm not sure what the solution is but as more and more apps start to use CNI, I'm seeing them fight over the /etc/cni/net.d directory. For example, RH CoreOS pre-installs podman, which includes its own CNI in /etc/cni/net.d.
If you then install kubernetes on the same system, you'd typically want to install a kubernetes focussed CNI (such as Calico or Flannel) but:
CRIO also installs its own CNI by default.
In general the problems this causes are strange and confusing for an end user who didn't even know they had podman installed. They just see broken networking with some pods getting IPs from a different IP range.
I think it'd be good if the CNI spec could address this somehow. In general, I think it's more common to want a different CNI for each app that's installed rather than to share.
I suppose one option would be to add something to the netconf that says "this config should only be used by kubernetes/podman/whatever". Then the bootstrap CNIs installed by those apps could include such a stanza.