Kubernetes wants to stop distributing kubernetes-cni package

[afbjorklund]

Description

Currently we are using the upstream binaries that are installed in /opt/cni.

But Kubernetes and kubeadm wants to stop packaging "kubernetes-cni".

• Consider discontinuing the kubernetes-cni package kubernetes/release#4156

Once they are no longer there, we need to switch to /usr/local/libexec/cni.

It is the same binaries (same source at least), just that they are installed separately.

Files /opt/cni/bin/LICENSE and /usr/local/libexec/cni/LICENSE are identical
Files /opt/cni/bin/README.md and /usr/local/libexec/cni/README.md are identical
Binary files /opt/cni/bin/bandwidth and /usr/local/libexec/cni/bandwidth differ
Binary files /opt/cni/bin/bridge and /usr/local/libexec/cni/bridge differ
Binary files /opt/cni/bin/dhcp and /usr/local/libexec/cni/dhcp differ
Binary files /opt/cni/bin/dummy and /usr/local/libexec/cni/dummy differ
Binary files /opt/cni/bin/firewall and /usr/local/libexec/cni/firewall differ
Only in /opt/cni/bin/: flannel
Binary files /opt/cni/bin/host-device and /usr/local/libexec/cni/host-device differ
Binary files /opt/cni/bin/host-local and /usr/local/libexec/cni/host-local differ
Binary files /opt/cni/bin/ipvlan and /usr/local/libexec/cni/ipvlan differ
Binary files /opt/cni/bin/loopback and /usr/local/libexec/cni/loopback differ
Binary files /opt/cni/bin/macvlan and /usr/local/libexec/cni/macvlan differ
Binary files /opt/cni/bin/portmap and /usr/local/libexec/cni/portmap differ
Binary files /opt/cni/bin/ptp and /usr/local/libexec/cni/ptp differ
Binary files /opt/cni/bin/sbr and /usr/local/libexec/cni/sbr differ
Binary files /opt/cni/bin/static and /usr/local/libexec/cni/static differ
Binary files /opt/cni/bin/tap and /usr/local/libexec/cni/tap differ
Binary files /opt/cni/bin/tuning and /usr/local/libexec/cni/tuning differ
Binary files /opt/cni/bin/vlan and /usr/local/libexec/cni/vlan differ
Binary files /opt/cni/bin/vrf and /usr/local/libexec/cni/vrf differ

Note: currently kubernetes uses 1.7.1, while nerdctl-full uses 1.8.0

https://github.com/containernetworking/plugins/releases

Installing the LICENSE and README in "bin" is an upstream packaging issue.

And the "flannel" binary is being installed from the kubernetes manifest:

      initContainers:
      - args:
        - -f
        - /flannel
        - /opt/cni/bin/flannel
        command:
        - cp
        image: ghcr.io/flannel-io/flannel-cni-plugin:v1.6.2-flannel1
        name: install-cni-plugin
        volumeMounts:
        - mountPath: /opt/cni/bin
          name: cni-plugin
      - args:
        - -f
        - /etc/kube-flannel/cni-conf.json
        - /etc/cni/net.d/10-flannel.conflist
        command:
        - cp
        image: ghcr.io/flannel-io/flannel:v0.26.7
        name: install-cni
        volumeMounts:
        - mountPath: /etc/cni/net.d
          name: cni
        - mountPath: /etc/kube-flannel/
          name: flannel-cfg

https://github.com/flannel-io/cni-plugin/releases

Easiest might be a symlink (for compatibility), instead of changing all config?

/opt/cni -> /usr/local/libexec/cni

There is already a conflict with the configuration directory, /etc/cni/net.d.

rm -f /etc/cni/net.d/*.conf*

The current workaround is to name the file so that it is first alphabetically.
Kubernetes doesn't support more than one config, while containerd does.
Trying to move the location of the config directory is an equal headache...

[afbjorklund]

I created an issue, for the missing "vcs" information in the flannel cni plugin:

• Different binaries in the docker image and in the release tarball flannel-io/cni-plugin#135

It uses a different build script now, so it doesn't include the git information...

build	-ldflags="-extldflags \"-static\"  -w      -X main.Version=v1.6.2-flannel1     -X main.Commit=ed95d6d3 ...

build	vcs=git
build	vcs.revision=ed95d6d3cdd5e9d49907d1c851ddebb3b6db0b27
build	vcs.time=2025-01-31T08:50:04Z
build	vcs.modified=false

[afbjorklund]

This change might also impact crictl from the cri-tools package (also OBS).

It used to be required by kubeadm, but not anymore (since Kubernetes 1.32)

---

Unfortunately crictl is no longer provided with containerd (or nerdctl-full):

https://github.com/containerd/containerd/blob/main/docs/cri/crictl.md

So it needs to be installed separately, if you want it in addition to ctr and nerdctl.

https://kubernetes.io/docs/tasks/debug/debug-cluster/crictl/ (cri-tools)