kadet-hub logokadet-hub

multus

Renders Multus CNI NetworkAttachmentDefinitions from inventory parameters, serialising structured CNI config to JSON.

kubernetesnetworking

Latest
1.0.2 ·
License
Apache-2.0
Owners
Moep90
Source
github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up
👍 0 on GitHub Discussions
Popularity
18 · 433 pulls

Request a feature Report a problem

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/multus/badge.json)](https://kadet-hub.org/generators/multus/)

Multus Generator

Published on kadet-hub: pin a released version by digest from its catalog page.

Kapitan kadet generator for Multus CNI NetworkAttachmentDefinitions (k8s.cni.cncf.io/v1). Built for Multus CNI 4.3.1.

Each entry under networks renders one NetworkAttachmentDefinition. The CNI configuration is written as YAML in the inventory and serialised to the JSON string that spec.config expects, with sorted keys so the output is stable.

Only NetworkAttachmentDefinitions are rendered. The Multus install (DaemonSet, RBAC, CRD) belongs in the helm or kubernetes generator, and the k8s.v1.cni.cncf.io/networks annotation that attaches a pod to a network belongs on the workload.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/multus@sha256:<digest>
        output_path: lib/multus
    compile:
      - output_path: manifests/multus/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/multus

Inventory Contract

All keys live under parameters.generators.multus.

Key Description
namespace Default namespace. Falls back to parameters.namespace, then default.
networks.<name> One NetworkAttachmentDefinition named <name>, output key <namespace>/<name>-net-attach-def.

Every entry under networks accepts:

Key Result
namespace metadata.namespace and the output directory.
cni_config CNI config or config list (plugins) as a dict, serialised to JSON into spec.config. name is set to the entry name when absent.
config_json Raw JSON string written to spec.config verbatim. Wins over cni_config.
resource_name Annotation k8s.v1.cni.cncf.io/resourceName.
labels, annotations Metadata. Every resource also gets the label name: <name>.
spec Passed through to the resource spec.

Precedence is generator defaults < spec < flat keys: cni_config or config_json wins over spec.config and logs a warning, and resource_name wins over the same key in annotations.

An entry without cni_config, config_json or spec.config renders an empty spec. Multus then loads the CNI config file from its config directory whose name matches the NetworkAttachmentDefinition (GetCNIConfig, the NAD client version Multus 4.3.1 builds with).

Defaults and Shorthands

Input Result Source
cni_config without name name: <entry name> Multus injects the same name at runtime (GetCNIConfigFromSpec); the rendered config is complete without it.
resource_name: <resource> metadata.annotations["k8s.v1.cni.cncf.io/resourceName"] Multus matches this annotation against the device plugin or DRA resource name and passes the allocated device ID to the CNI plugin (how-to-use, k8sclient.go). The value must equal the resource name exactly.

cniVersion has no default: which versions a config may declare depends on the CNI plugin binaries installed on the nodes. Set it in cni_config, as the upstream examples do.

Example

parameters:
  generators:
    multus:
      namespace: networks
      networks:
        storage-net:
          cni_config:
            cniVersion: 1.0.0
            type: macvlan
            master: eth1
            mode: bridge
            ipam:
              type: host-local
              subnet: 192.168.100.0/24
              rangeStart: 192.168.100.10
              rangeEnd: 192.168.100.200
        sriov-net:
          resource_name: intel.com/sriov_vf
          cni_config:
            cniVersion: 1.0.0
            plugins:
              - type: sriov
                vlan: 100
                ipam:
                  type: host-local
                  subnet: 192.168.200.0/24
              - type: tuning
                sysctl:
                  net.ipv6.conf.IFNAME.accept_ra: "0"
        legacy-net:
          namespace: kube-system
          config_json: '{"cniVersion":"0.3.1","type":"macvlan","master":"eth0","ipam":{"type":"dhcp"}}'

This renders networks/storage-net-net-attach-def, networks/sriov-net-net-attach-def (with the resourceName annotation and a two-plugin config list named sriov-net) and kube-system/legacy-net-net-attach-def.

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

VersionBuilt for (schema-checked)
1.0.2Multus CNI 4.3.1
1.0.1Multus CNI 4.3.1
1.0.0Multus CNI 4.3.1
1.0.2

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/multus:1.0.2@sha256:c049cc2715835caff91d8acdba025065c3d39d0afe7b823f8f21878f5cfcef7b
        output_path: lib/multus

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/multus@sha256:c049cc2715835caff91d8acdba025065c3d39d0afe7b823f8f21878f5cfcef7b \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3250301455, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared
>=0.36.3,<0.37
Kapitan checked
0.36.3
Backends checked
not recorded
With --cache
not recorded
krab
compatible
Built for (schema-checked)
Multus CNI 4.3.1
Source
multus-v1.0.2 · e4891e8fd85ca0a19ebf361e8b54fd6473fd8a2f · multus
Binaries
none
Output capabilities
none
Digest
sha256:c049cc2715835caff91d8acdba025065c3d39d0afe7b823f8f21878f5cfcef7b

Checks

Checked by the release run on , gate at fe9998b5168d.

  • Secrets gitleaks 8.30.1
    No secret matched the marketplace's gitleaks rules.
  • Malware ClamAV 1.5.4
    No file matched a ClamAV signature.
  • Malicious package heuristics GuardDog 3.2.0
    No GuardDog threat rule matched.
  • Dangerous code Semgrep 1.180.0
    No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
  • Python errors Ruff 0.17.0
    No syntax error or undefined name (Ruff, error rules only).
  • File tree tree_check.py
    No symlink, executable or banned file; imports within the allowlist.
  • Sandboxed compile gVisor 20261005, Kapitan 0.36.3
    The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
  • Output capabilities Conftest 0.71.1
    The compiled output uses only the capabilities the manifest declares.
  • CI detection Kapitan 0.36.3
    The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.1

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/multus:1.0.1@sha256:f9a99b2ac4f4a94d817ce5208976f46038ad102f037d180200561ec229f1d3a8
        output_path: lib/multus

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/multus@sha256:f9a99b2ac4f4a94d817ce5208976f46038ad102f037d180200561ec229f1d3a8 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3244141853, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared
>=0.36.3,<0.37
Kapitan checked
0.36.3
Backends checked
not recorded
With --cache
not recorded
krab
compatible
Built for (schema-checked)
Multus CNI 4.3.1
Source
multus-v1.0.1 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · multus
Binaries
none
Output capabilities
none
Digest
sha256:f9a99b2ac4f4a94d817ce5208976f46038ad102f037d180200561ec229f1d3a8

Checks

Checked by the release run on , gate at ba634ff54963.

  • Secrets gitleaks 8.30.1
    No secret matched the marketplace's gitleaks rules.
  • Malware ClamAV 1.5.4
    No file matched a ClamAV signature.
  • Malicious package heuristics GuardDog 3.2.0
    No GuardDog threat rule matched.
  • Dangerous code Semgrep 1.180.0
    No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
  • Python errors Ruff 0.17.0
    No syntax error or undefined name (Ruff, error rules only).
  • File tree tree_check.py
    No symlink, executable or banned file; imports within the allowlist.
  • Sandboxed compile gVisor 20261005, Kapitan 0.36.3
    The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
  • Output capabilities Conftest 0.71.1
    The compiled output uses only the capabilities the manifest declares.
  • CI detection Kapitan 0.36.3
    The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/multus:1.0.0@sha256:852b768801e2e518f41323f94bdc26353d49fa0b7f826e2c7de788113206f16f
        output_path: lib/multus

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/multus@sha256:852b768801e2e518f41323f94bdc26353d49fa0b7f826e2c7de788113206f16f \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3211169660, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared
>=0.36.3,<0.37
Kapitan checked
0.36.3
Backends checked
not recorded
With --cache
not recorded
krab
compatible
Built for (schema-checked)
Multus CNI 4.3.1
Source
multus-v1.0.0 · 91b3915d464dd9327ffce043f5ae528c26de7dff · multus
Binaries
none
Output capabilities
none
Digest
sha256:852b768801e2e518f41323f94bdc26353d49fa0b7f826e2c7de788113206f16f

Checks

Checked by the release run on , gate at 994707bbec61.

  • Secrets gitleaks 8.30.1
    No secret matched the marketplace's gitleaks rules.
  • Malware ClamAV 1.5.4
    No file matched a ClamAV signature.
  • Malicious package heuristics GuardDog 3.2.0
    No GuardDog threat rule matched.
  • Dangerous code Semgrep 1.180.0
    No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
  • Python errors Ruff 0.17.0
    No syntax error or undefined name (Ruff, error rules only).
  • File tree tree_check.py
    No symlink, executable or banned file; imports within the allowlist.
  • Sandboxed compile gVisor 20261005, Kapitan 0.36.3
    The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
  • Output capabilities Conftest 0.71.1
    The compiled output uses only the capabilities the manifest declares.
  • CI detection Kapitan 0.36.3
    The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.