Repository navigation
docs: record CNI chaining spike findings and decision not to pursue - #196
Merged
Merged
Conversation
Record the findings and learnings from the CNI chaining spike in docs/design/spikes/cni-plugin.md. Document the decision not to pursue CNI chaining in favor of NRI (gke-labs#159), covering verification on kind, fail-closed ordering, pod identity, platform conflicts on GKE, bypasses (sandboxed runtimes, UID 1337, IPv6), and carrying forward the host-side interface observation for microVM enforcement (gke-labs#181). Fixes gke-labs#194
justinsb
approved these changes
Nov 3, 2026
justinsb
left a comment
justinsb
left a comment
Collaborator
There was a problem hiding this comment.
Docs-only against current main, and it covers everything #194 asked for: status not pursued because the #159 comparison chose NRI; what the spike built and observed on kind (conflist chaining, API lookup with a node kubeconfig, nsenter rules, ordering ahead of init containers, fail-closed on plugin error); the four observed reasons; the identity statement as it actually was (no RemoteAddr to pod mapping); the prevResult host-side interface carried into #181; and an NRI comparison that is accurate about RunPodSandbox/StopPodSandbox and the rollout window. No license header, 83 lines.
Assigning to @justinsb for the merge.
justinsb
approved these changes
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #194