feat(kubernetes): add cni-sidecar supervisor topology - #2606

Closed

russellb wants to merge 29 commits into

NVIDIA:mainfrom

russellb:feat/kubernetes-cni-sidecar-topology

Commits on Sep 8, 2026

feat(kubernetes): add cni-sidecar supervisor topology

TaylorMutch
authored and
Russell Bryant
committed
040024c
docs(cni): design for cni-sidecar on OpenShift Multus

russellb
authored and
Russell Bryant
committed
e56d1f0
feat(cni): add multus-chain install mode for OpenShift

russellb
authored and
Russell Bryant
committed
76b681f
feat(cni): add gated privileged SCC for OpenShift

russellb
authored and
Russell Bryant
committed
cdc36e8
feat(helm): add OpenShift cni-sidecar values overlay

russellb
authored and
Russell Bryant
committed
b7f2f90
docs(cni): document OpenShift multus-chain mode

russellb
authored and
Russell Bryant
committed
07d84a1
fix(cni): scope privileged SCC to a dedicated CNI service account

russellb
authored and
Russell Bryant
committed
202088a
feat(helm): add minimal sandbox SCC for OpenShift binary-aware policy

russellb
authored and
Russell Bryant
committed
c791869
docs(rfc): propose cni-sidecar supervisor topology

russellb
authored and
Russell Bryant
committed
103b387
docs(rfc): link topology PRs in cni-sidecar RFC

russellb
authored and
Russell Bryant
committed
7e3af74
fix(cni-sidecar): address review findings for OpenShift topology

russellb
authored and
Russell Bryant
committed
19b1ee2
fix(cni-sidecar): close egress-enforcement gaps from re-review

russellb
authored and
Russell Bryant
committed
0b9085d
fix(cni-sidecar): harden readiness lifecycle, init, and IPv6 detection

russellb
authored and
Russell Bryant
committed
da32f5d
fix(cni-sidecar): make the CNI installer a cluster singleton

russellb
authored and
Russell Bryant
committed
ea414ae
fix(cni-sidecar): drop brittle owner guard, upgrade any openshell-cni entry in place

russellb
authored and
Russell Bryant
committed
bcdec5f
fix(cni-sidecar): harden sidecar init, scope API lookups, gate reboots

russellb
authored and
Russell Bryant
committed
c207273
docs(cni-sidecar): correct multi-release workflow, boot-taint, and singleton docs

russellb
authored and
Russell Bryant
committed
8396e40
feat(cni-sidecar): auto-aggregate sandbox namespaces into the CNI allowlist

russellb
authored and
Russell Bryant
committed
d4d8115
feat(cni-sidecar): Helm-owned registration marker + wait-for-ack gate

russellb
authored and
Russell Bryant
committed
1205a36
fix(cni): harden cni-sidecar egress enforcement

russellb
authored and
Russell Bryant
committed
352f32d
fix(cni): correct k3s CNI bin path and stale registration docs

russellb
authored and
Russell Bryant
committed
a9d5f8b
chore: stop tracking docs/superpowers scratch dir

russellb
authored and
Russell Bryant
committed
78cc628
feat(cni): standalone CNI-only install mode for independent lifecycle

russellb
authored and
Russell Bryant
committed
dd774a1
docs(cni): point OpenShift multi-gateway guidance at standalone CNI

russellb
authored and
Russell Bryant
committed
79478a3
fix(cni): review fixes + fail-closed contract-version gate

russellb
authored and
Russell Bryant
committed
b839bfe
docs(rfc): cover CNI contract versioning for mixed-version clusters

russellb
authored and
Russell Bryant
committed
ae189f4
fix(cni): handle CniSidecar in upstream-proxy-auth secret mode

russellb
authored and
Russell Bryant
committed
ced96d1
fix(helm): skip Agent Sandbox preflight in cni-only mode
russellb
committed
b9a43fa
fix(cni): satisfy Rust 1.95 clippy lints in the CNI plugin
Russell Bryant
committed
3d0799f

Navigation Menu

Uh oh!

feat(kubernetes): add cni-sidecar supervisor topology - #2606

feat(kubernetes): add cni-sidecar supervisor topology#2606
russellb wants to merge 29 commits into
NVIDIA:mainfrom
russellb:feat/kubernetes-cni-sidecar-topology

Commits on Sep 8, 2026

feat(kubernetes): add cni-sidecar supervisor topology

docs(cni): design for cni-sidecar on OpenShift Multus

feat(cni): add multus-chain install mode for OpenShift

feat(cni): add gated privileged SCC for OpenShift

feat(helm): add OpenShift cni-sidecar values overlay

docs(cni): document OpenShift multus-chain mode

fix(cni): scope privileged SCC to a dedicated CNI service account

feat(helm): add minimal sandbox SCC for OpenShift binary-aware policy

docs(rfc): propose cni-sidecar supervisor topology

docs(rfc): link topology PRs in cni-sidecar RFC

fix(cni-sidecar): address review findings for OpenShift topology

fix(cni-sidecar): close egress-enforcement gaps from re-review

fix(cni-sidecar): harden readiness lifecycle, init, and IPv6 detection

fix(cni-sidecar): make the CNI installer a cluster singleton

fix(cni-sidecar): drop brittle owner guard, upgrade any openshell-cni entry in place

fix(cni-sidecar): harden sidecar init, scope API lookups, gate reboots

docs(cni-sidecar): correct multi-release workflow, boot-taint, and singleton docs

feat(cni-sidecar): auto-aggregate sandbox namespaces into the CNI allowlist

feat(cni-sidecar): Helm-owned registration marker + wait-for-ack gate

fix(cni): harden cni-sidecar egress enforcement

fix(cni): correct k3s CNI bin path and stale registration docs

chore: stop tracking docs/superpowers scratch dir

feat(cni): standalone CNI-only install mode for independent lifecycle

docs(cni): point OpenShift multi-gateway guidance at standalone CNI

fix(cni): review fixes + fail-closed contract-version gate

docs(rfc): cover CNI contract versioning for mixed-version clusters

fix(cni): handle CniSidecar in upstream-proxy-auth secret mode

fix(helm): skip Agent Sandbox preflight in cni-only mode

fix(cni): satisfy Rust 1.95 clippy lints in the CNI plugin