From b32a5e07478ac47501856d3bd21f6ff0ddc75ab1 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 5 Oct 2026 02:01:34 +0000 Subject: [PATCH 1/2] chore(deps): update multus cni --- kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml | 4 ++-- kubernetes/infrastructure/multus/multus-daemonset.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml b/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml index b89a28e8..eef96cbc 100644 --- a/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml +++ b/kubernetes/infrastructure/multus/cni-dhcp-daemon.yaml @@ -71,7 +71,7 @@ spec: # socket's parent, and refuses to start if the socket file is left # over from an unclean shutdown (bind: address already in use). - name: clean-socket - image: alpine:3.21 + image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 command: ["sh", "-c", "rm -f /run/cni/dhcp.sock"] volumeMounts: - name: run-cni @@ -83,7 +83,7 @@ spec: # Any image with a shell works: the binary executed here is the # host's, bind-mounted from /opt/cni/bin. Pinned to the same # alpine tag the sibling installer uses. - image: alpine:3.21 + image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 command: - /opt/cni/bin/dhcp - daemon diff --git a/kubernetes/infrastructure/multus/multus-daemonset.yaml b/kubernetes/infrastructure/multus/multus-daemonset.yaml index 527d2530..4601d5d1 100644 --- a/kubernetes/infrastructure/multus/multus-daemonset.yaml +++ b/kubernetes/infrastructure/multus/multus-daemonset.yaml @@ -206,7 +206,7 @@ spec: serviceAccountName: multus containers: - name: kube-multus - image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.4-thick + image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.3.1-thick@sha256:a357a79359b80ddd5f4699117946cacf3b54f5baecf7944535594863e875fc25 command: [ "/usr/src/multus-cni/bin/multus-daemon" ] resources: # Bumped from upstream's 100m/50Mi: on a clean rebuild the edge @@ -268,7 +268,7 @@ spec: fieldPath: spec.nodeName initContainers: - name: install-multus-binary - image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.4-thick + image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.3.1-thick@sha256:a357a79359b80ddd5f4699117946cacf3b54f5baecf7944535594863e875fc25 command: - "/usr/src/multus-cni/bin/install_multus" - "-d" -- 2.54.0 From 90a547546e7c4bab76a3ecd2acd28b22c1938605 Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Mon, 5 Oct 2026 17:00:29 +0000 Subject: [PATCH 2/2] fix(multus): re-vendor v4.3.1 thick manifest changes Upstream deployments/multus-daemonset-thick.yml v4.2.4 -> v4.3.1 adds: - ClusterRole rule: resource.k8s.io resourceclaims, resourceclaims/status, resourceslices; get, list (new DRA client) - terminationGracePeriodSeconds 10 -> 30 - CRD shortName nad Header comment updated to v4.3.1 (v4.3.1 also has an unsuffixed tag; we keep -thick to match the manifest). Refs: REN-722 Co-Authored-By: Claude Opus 5.5 --- .../multus/multus-daemonset.yaml | 23 ++++++++++++++----- 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/kubernetes/infrastructure/multus/multus-daemonset.yaml b/kubernetes/infrastructure/multus/multus-daemonset.yaml index 4601d5d1..cffb217b 100644 --- a/kubernetes/infrastructure/multus/multus-daemonset.yaml +++ b/kubernetes/infrastructure/multus/multus-daemonset.yaml @@ -1,5 +1,5 @@ -# Vendored from k8snetworkplumbingwg/multus-cni v4.2.4 thick daemonset: -# https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/v4.2.4/deployments/multus-daemonset-thick.yml +# Vendored from k8snetworkplumbingwg/multus-cni v4.3.1 thick daemonset: +# https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/v4.3.1/deployments/multus-daemonset-thick.yml # # Why vendored, not Helm: there is no published Helm repository for this # project — the upstream k8snetworkplumbingwg/helm-charts repo only ships @@ -7,10 +7,11 @@ # https://k8snetworkplumbingwg.github.io/helm-charts/ 404s. # # Why thick (not thin): the only version-pinned image tag published for -# v4.2.4 is `v4.2.4-thick` — there is no `v4.2.4-thin` or unsuffixed +# v4.2.4 was `v4.2.4-thick` — there was no `v4.2.4-thin` or unsuffixed # `v4.2.4` tag (verified against ghcr.io/k8snetworkplumbingwg/multus-cni -# package versions). The thin variant only ships under moving tags -# (snapshot, latest), which we don't want for reproducibility. +# package versions). The thin variant only shipped under moving tags +# (snapshot, latest), which we don't want for reproducibility. v4.3.1 also +# publishes an unsuffixed tag; we keep `-thick` so image and manifest match. # # Talos compatibility: the daemon chroots into /hostroot to exec CNI # plugin binaries from /opt/cni/bin on the host. Talos's rootfs is @@ -30,6 +31,7 @@ spec: kind: NetworkAttachmentDefinition shortNames: - net-attach-def + - nad versions: - name: v1 served: true @@ -82,6 +84,15 @@ rules: - list - update - watch + - apiGroups: + - "resource.k8s.io" + resources: + - resourceclaims + - resourceclaims/status + - resourceslices + verbs: + - get + - list - apiGroups: - "" - events.k8s.io @@ -286,7 +297,7 @@ spec: - name: cnibin mountPath: /host/opt/cni/bin mountPropagation: Bidirectional - terminationGracePeriodSeconds: 10 + terminationGracePeriodSeconds: 30 volumes: - name: cni hostPath: -- 2.54.0