This guide provides a detailed exploration of Container Network Interface (CNI) architecture, implementation details, and internal workings. Understanding these concepts is crucial for advanced networking configurations and troubleshooting.

CNI Architecture

Core Components

  1. CNI Plugin Interface

    type CNI interface {
    AddNetworkList(ctx context.Context, net *NetworkConfigList, rt *RuntimeConf) (types.Result, error)
    DelNetworkList(ctx context.Context, net *NetworkConfigList, rt *RuntimeConf) error
    AddNetwork(ctx context.Context, net *NetworkConfig, rt *RuntimeConf) (types.Result, error)
    DelNetwork(ctx context.Context, net *NetworkConfig, rt *RuntimeConf) error
}

  2. Runtime Configuration

    type RuntimeConf struct {
    ContainerID string
    NetNS       string
    IfName     string
    Args       [][2]string
    CapabilityArgs map[string]interface{}
}

Plugin Execution Flow

Container Runtime
      ↓
CNI Configuration
      ↓
Plugin Selection
      ↓
Network Setup
      ↓
IP Address Management

CNI Specification Details

1. Plugin Operations

ADD Operation

# Example ADD operation
$ echo '{"cniVersion":"0.4.0","name":"example","type":"bridge"}' | \
  CNI_COMMAND=ADD \
  CNI_CONTAINERID=example \
  CNI_NETNS=/var/run/netns/example \
  CNI_IFNAME=eth0 \
  CNI_PATH=/opt/cni/bin \
  /opt/cni/bin/bridge

DEL Operation

# Example DEL operation
$ echo '{"cniVersion":"0.4.0","name":"example","type":"bridge"}' | \
  CNI_COMMAND=DEL \
  CNI_CONTAINERID=example \
  CNI_NETNS=/var/run/netns/example \
  CNI_IFNAME=eth0 \
  CNI_PATH=/opt/cni/bin \
  /opt/cni/bin/bridge

2. Network Configuration

{
  "cniVersion": "0.4.0",
  "name": "example-network",
  "type": "bridge",
  "bridge": "cni0",
  "isGateway": true,
  "ipMasq": true,
  "ipam": {
    "type": "host-local",
    "subnet": "10.22.0.0/16",
    "routes": [
      { "dst": "0.0.0.0/0" }
    ]
  }
}

IPAM Deep Dive

1. Host-Local IPAM

type IPAMConfig struct {
    Type string         `json:"type"`
    Routes []Route      `json:"routes"`
    ResolvConf string   `json:"resolveConf"`
    DataDir string      `json:"dataDir"`
    Subnet string       `json:"subnet"`
    RangeStart string   `json:"rangeStart"`
    RangeEnd string     `json:"rangeEnd"`
    Gateway string      `json:"gateway"`
}

2. DHCP IPAM

apiVersion: v1
kind: DaemonSet
metadata:
  name: dhcp-daemon
spec:
  selector:
    matchLabels:
      name: dhcp-daemon
  template:
    metadata:
      labels:
        name: dhcp-daemon
    spec:
      hostNetwork: true
      containers:
      - name: dhcp-daemon
        image: networkop/dhcp-cni
        securityContext:
          privileged: true

Plugin Implementation Details

1. Bridge Plugin Architecture

type NetConf struct {
    types.NetConf
    BrName       string `json:"bridge"`
    IsGW        bool   `json:"isGateway"`
    IsDefaultGW bool   `json:"isDefaultGateway"`
    ForceAddress bool  `json:"forceAddress"`
    IPMasq      bool   `json:"ipMasq"`
    MTU         int    `json:"mtu"`
    HairpinMode bool   `json:"hairpinMode"`
}

2. VXLAN Implementation

type VXLANNetConf struct {
    types.NetConf
    VXLANId     int    `json:"vxlanId"`
    Port        int    `json:"port"`
    GBP         bool   `json:"gbp"`
    DirectRouting bool `json:"directRouting"`
}

Advanced Networking Concepts

1. Network Namespaces

# Create network namespace
ip netns add example

# Configure veth pair
ip link add veth0 type veth peer name veth1
ip link set veth1 netns example

# Configure IP addresses
ip addr add 10.0.0.1/24 dev veth0
ip netns exec example ip addr add 10.0.0.2/24 dev veth1

2. eBPF Integration

// Example eBPF program
SEC("xdp")
int xdp_drop_icmp(struct xdp_md *ctx) {
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;
    struct ethhdr *eth = data;
    
    if ((void*)eth + sizeof(*eth) <= data_end) {
        struct iphdr *iph = (void*)eth + sizeof(*eth);
        if ((void*)iph + sizeof(*iph) <= data_end) {
            if (iph->protocol == IPPROTO_ICMP) {
                return XDP_DROP;
            }
        }
    }
    return XDP_PASS;
}

Performance Optimization

1. MTU Optimization

# Check current MTU
ip link show

# Set optimal MTU for VXLAN
ip link set dev vxlan0 mtu 1450

2. Kernel Parameters

# Network performance tuning
sysctl -w net.core.somaxconn=1024
sysctl -w net.core.netdev_max_backlog=5000
sysctl -w net.ipv4.tcp_max_syn_backlog=4096

Debugging and Troubleshooting

1. CNI Debug Logging

# Enable CNI debug logging
export CNI_LOG_LEVEL=debug
export CNI_LOG_FILE=/var/log/cni.log

# Analyze logs
tail -f /var/log/cni.log

2. Network Tracing

# Trace network calls
strace -e trace=network -f -p $(pgrep kubelet)

# Monitor CNI operations
tcpdump -i any -nn "port 4789"

Security Considerations

1. Network Policy Implementation

type NetworkPolicySpec struct {
    PodSelector metav1.LabelSelector
    Ingress     []NetworkPolicyIngressRule
    Egress      []NetworkPolicyEgressRule
    PolicyTypes []PolicyType
}

2. Security Context

securityContext:
  capabilities:
    add: ["NET_ADMIN", "NET_RAW"]
  privileged: false

Best Practices

  1. Plugin Selection

    • Consider workload requirements
    • Evaluate performance needs
    • Assess security requirements

  2. Configuration Management

    • Version control CNI configs
    • Document customizations
    • Regular audits

  3. Monitoring

    • Implement metrics collection
    • Set up alerting
    • Regular performance testing

Conclusion

Understanding CNI architecture and implementation details is crucial for:

  • Troubleshooting network issues
  • Optimizing performance
  • Implementing security measures
  • Custom plugin development

For more information, check out: