k8snetworkplumbingwg / network-attachment-definition-client Goto Github PK

This is with reference to https://nvd.nist.gov/vuln/detail/CVE-2021-3121#vulnCurrentDescriptionTitle

Network attachment is using type apimachinery.pkg.runtime.serializer.DirectCodecFactory, which is replace with WithoutConversionCodecFactory starting from release 1.16.

When use the Network attachment keep getting the error serializer.DirectCodecFactory not found.

What happend:

Created some resources using multus and multiple networks. Annotations added to pods did not match spec.

What you expected to happen:

According to the spec (https://docs.google.com/document/d/1Ny03h6IDVy_e_vmElOqR7UdTPAG_RNydhVE1Kx54kFQ/) this should lead to an annotation k8s.v1.cni.cncf.io/network-status, but it appeared that the annotation I got was k8s.v1.cni.cncf.io/networks-status (note the extra s to make it networks, not network).

That appears to be a simple typo in the code.

The device-info spec appears in the pod's network-status annotation when the NAD config only contains a single plugin using the "type" filed in the cni spec.

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  annotations:
    k8s.v1.cni.cncf.io/resourceName: intel.com/pci_sriov_net_f1
  name: test-net
  namespace: test
spec:
  config: '{
    "cniVersion": "0.3.1",
    "name": "test",
    **"type": "sriov",**

However when the "plugins" list of the cni spec (https://github.com/containernetworking/cni/blob/main/SPEC.md) is used for the NAD to invoke more than one plugin in a NAD, the device-info-spec is missing in the pod network-status annotation

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  annotations:
    k8s.v1.cni.cncf.io/resourceName: intel.com/pci_sriov_net_f1
  name: test-net
  namespace: test
spec:
  config: '{
   "cniVersion" : "0.3.1",
   "name" : "networking-f1c",
   **"plugins" : [**
      {
         "ipam" : {
            "type" : "static"
         },
         "name" : "test",
         **"type" : "sriov",**
         "vlan" : 821,
         "spoofchk": "on",
         "trust":"off",
         "link_state": "auto"
      },
      {
         **"type": "tuning"**,
         "sysctl": { 
            "net.ipv6.conf.test.disable_ipv6": "1"
         }
       }
   ]
}'

We should add a test-go.sh script and GH actions to run that, as well.

Hi,

I propose to release 1.4.0 version of network-attachment-definition-client with following content:

• #42
• #49

@adrianchiris @phoracek @dougbtv
WDYT?

Will this work with kubernetes 1.20.4 ?