Stretching CNI Boundaries with Service Meshes, a Roadmap for the Future
summary
Linkerd moves iptables setup out of init containers into a host-installed CNI plugin so pods avoid NET_ADMIN privileges, but two failure modes appear: independent installers overwrite each other’s config and nodes can schedule pods before CNI files exist. A DaemonSet copies CNI binaries and rewrites configs into a conflist chain to avoid shadowing, and a validator init container listens on port 4140 to verify outbound traffic redirects back to the proxy; solution works but causes restarts and calls for ordered CNI installation or runtime-level plugin management.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 0:33Overview
- 1:18Agenda
- 1:51What is LDN
- 3:05What is a Service Mesh
- 4:08Elevated Privileges
- 5:00What is CNI
- 5:37CNI Plugins
- 6:35Multiple Plugins
- 6:55Linker DCNI
- 7:32Traditional CNI Plugin Setup
- 8:28Installing the CNI Plugin
- 9:27Running multiple CNI plugins
- 9:45Installing multiple CNI plugins
- 10:30CNI conflict files
- 11:21CNI plugin manager
- 12:36How could it be better
- 14:04CNI plugin race conditions
- 14:35What happens when this occurs
- 14:51Scheduling pods
- 15:14Pods in a broken state
- 16:37Validate routing on pod startup
- 17:49Validator Pod
- 21:11Recap
- 21:55Service Mesh Academy
- 22:24Fully Managed Link Reviews
- 22:47Linker D Booth
- 23:06Jank
related talks
26mNetworking the Service Mesh Proxy: Where We Are, Where We’re Going
33mKubernetes Networking: How to Write a CNI Plugin From Scratch
31mFrom CNI to Service Mesh: Demystifying Kubernetes Networking
37mIntroduction to CNI, the Container Network Interface Project
37mKubernetes and the CNI: Where We Are and What's Next - Casey Callendrello, CoreOS
40mModular Overlay Networking Solutions with the Container Network Interface
31mMayday! CNI Overboard!
40mCloud, Kubernetes, and Service Networking - Taming the Turtles