CubeSandbox on Kubernetes, compute node image build and deploy.

[wwthw]

CubeSandbox on Kubernetes, compute node image build and deploy.

TencentCloud#636

[ji-cy]

Did you modify the code of network-agent? What does eBPF/Tap/TCP (host netns via netlink HandleAt) mean? It looks like you changed the source code—could you share it?

[wwthw]

Did you modify the code of network-agent? What does eBPF/Tap/TCP (host netns via netlink HandleAt) mean? It looks like you changed the source code—could you share it?

I'll push all my modified code.

[zyl1121]

Nice work on the K8s deployment packaging. I have a few concerns about CNI compatibility:

TC BPF filter conflict with eBPF-mode CNIs:

network-agent calls cubevs.Init() which attaches TC BPF filters to eth0 ingress and lo ingress via legacy TC netlink (tnl.Filter().Replace() in CubeNet/cubevs/tc.go:43-75). Cilium in eBPF mode attaches its own TC BPF programs (from-netdev, to-netdev) to the same host interfaces — the two will overwrite each other, breaking either CubeSandbox networking or Cilium's kube-proxy replacement / host routing.

The bpffs mount-namespace isolation in start-network-agent.sh correctly solves the map pinning conflict, but the TC filter attachment conflict remains unresolved.

This means any K8s cluster running Cilium eBPF dataplane (or Calico eBPF mode) is incompatible with this deployment.

Questions:

1. What CNI / kube-proxy mode was this tested with?
2. Could you add CNI compatibility notes to the PR description or a README?