Including more CNI binaries

[buroa]

Can we add a few more cni binaries to support other cnis such as multus?

This would remove the need to have some sort of container to install them for us as it would work out of the box.

Looking at particularly macvlan and sbr.

See here: siderolabs/extras#153

[smira]

Talos provides a set of CNI binaries that are the most common, and these are enough for Flannel, Calico and Cilium. I would rather not expand the base system image with CNI plugins that are required only in some really special cases like Multus, but rather take it out e.g. as a system extension.

There are two ways to solve this:

• /opt/cni/bin is actually an overlay mount, so it's writeable, and you can do an init container which drops any plugins you might want
• extend Talos base image so that /opt/cni/bin comes with the plugins it wants.

Talos base plugins:

talos/Dockerfile

Lines 231 to 236 in b8b7b83

	COPY --from=pkg-cni-amd64 /opt/cni/bin/bridge /opt/cni/bin/bridge
	COPY --from=pkg-cni-amd64 /opt/cni/bin/firewall /opt/cni/bin/firewall
	COPY --from=pkg-cni-amd64 /opt/cni/bin/host-local /opt/cni/bin/host-local
	COPY --from=pkg-cni-amd64 /opt/cni/bin/loopback /opt/cni/bin/loopback
	COPY --from=pkg-cni-amd64 /opt/cni/bin/portmap /opt/cni/bin/portmap

So the system extension should be (relatively) trivial, as Talos already builds CNI plugins in pkgs, the only change that might be required is to allow /opt/cni/bin to be part of a system extension (

talos/pkg/machinery/extensions/extensions.go

Lines 10 to 12 in b8b7b83

	// AllowedPaths lists paths allowed in the extension images.
	var AllowedPaths = []string{
	"/etc/cri/conf.d",

).

I could envision something like cni-extra-plugins extension which adds all plugins which are not included into base Talos.