Allow setting sysctls on a particular interface

[jellonek]

As in subject.

[mccv1r0]

/lgtm

[dcbw]

@jellonek could you also update the documentation at https://github.com/containernetworking/cni.dev/blob/main/content/plugins/current/meta/tuning.md with this new behavior?

[mccv1r0]

An argument can be made that tuning plugin should have been interface specific from the beginning, that is, each e.g. cniADD for a conflist is specific to just one IFNAME. Should we just do that?

[jellonek]

@dcbw done: containernetworking/cni.dev#92
@mccv1r0 imo it's kinda tempting, but it would cripple possibility to e.g. change sysctls for netfilters, or for bgp (in net.core). The question is - do we really want that? Even our own example in docs now is based on net.core.somaxconn.

[mars1024]

An argument can be made that tuning plugin should have been interface specific from the beginning, that is, each e.g. cniADD for a conflist is specific to just one IFNAME. Should we just do that?

I'm wondering whether replacing IFNAME is too simple to be maintained or extended further, IMO, this problems can be solved well by template rendering, e.g. go-template or jinja2, no matter the arguments coming from CNI args, network config or dynamic configuration.

[jellonek]

@mccv1r0 imo we should move discussion about if we want or not limiting changing sysctls only to net.ipv[46].conf.IFNAME to a separate issue, as a followup. For sure that would be breaking change and would require a bump to 1.1.0.
fyi: i seen in wild tuning plugin used like:

apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: enable-forwarding
spec:
  config: '{
      "cniVersion": "0.3.1",
      "plugins": [
        {
          "type": "loopback"
        },
        {
          "name": "enable-forwarding",
          "type": "tuning",
          "sysctl": {
                  "net.ipv4.conf.all.forwarding": "1",
                  "net.ipv6.conf.all.forwarding": "1",
                  "net.ipv6.conf.default.forwarding":"1",
                  "net.ipv6.conf.default.disable_ipv6":"0",
                  "net.ipv6.conf.all.disable_ipv6": "0",
                  "net.ipv4.conf.default.rp_filter": "2",
                  "net.ipv4.conf.all.rp_filter": "2"
          }
        }
      ]
    }'

[dcbw]

/lgtm