Make the tenant network a Pod's default network - #9
Merged
Conversation
An injected Pod carried its interfaces as Multus secondaries and kept the cluster CNI as its default network. On a cell where guests are microVMs that costs the instance its primary interface: the runtime reaches only the host root namespace, so a default network plumbed into the Pod's namespace can never reach the guest. Name the instance's first interface in v1.multus-cni.io/default-network alongside the existing networks annotation, so the Pod's default network is the one the tenant asked for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
privateip
approved these changes
Aug 25, 2026
privateip
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An injected Pod carries its interfaces as Multus secondaries and keeps the cluster CNI as its default network.
On a cell where guests are microVMs that costs the instance its primary interface. The runtime daemon runs in the host network namespace with no access to
/run/netns, so a default network plumbed into the Pod's namespace can never reach the guest — the guest ends up with one NIC on a tap that is connected to nothing, while the address the Pod advertises answers nobody.Names the instance's first interface in
v1.multus-cni.io/default-network, in the same<namespace>/<name>form as the networks annotation, so the Pod's default network is the one the tenant asked for.Worth a look before merging
v1.multus-cni.io/default-networktakes a single network, so this names the first interface rather than the whole list. Instances declaring more than one interface still get the rest as secondaries.That first interface is now named in both annotations. Multus is expected to treat the default-network entry as the Pod's primary rather than attaching it twice, but this has not been confirmed against a live sandbox yet — worth verifying on a cell before this reaches one that matters.
This does not by itself get an interface into a microVM guest: kraftlet drops IPv6 secondary CIDRs and requires a
subnet-lenNAD annotation that nothing emits. Those are separate and still open.🤖 Generated with Claude Code