Installing Genie CNI into AWS EKS with Kubernetes 1.18 fails. about cni-genie HOT 6 OPEN

Hi @darnone, try adding the following to the cni_genie_network_config:

        "cniVersion": "0.3.1",

We had the same issue moving from 1.15 to 1.16 (although we are using cilium). That's been working as well in 1.17, although we still have an issue with cni-genie leaking IPs (issue #214)

from cni-genie.

@darnone

add this to spec of genie-network-admission-controller DaemonSet and use apps/v1 apiVersion.

spec:
  selector:
    matchLabels:
      role: genie-network-admission-controller

That should fix your issue, but tbh I'm not sure what this daemonset does . Looks like this daemonset is configured to run on masters only. Since we're on EKS it doesn't schedule at all. See: #215 for my issue.

from cni-genie.

You never did get an answer to your issue #215 . So you moved that DaemonSet altogether and it still works? I see your point, since this is AWS, the control plane is managed to there is no real way to schedule anything on the master since you cannot able it. Right? Anyway, where exactly do I place the matchLabels? The spec of the deamonset, or the template, or the service? Like this?

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: genie-network-admission-controller
  namespace: kube-system
spec:
  selector:
    matchLabels:
      role: genie-network-admission-controller
  template:
    metadata:
      labels:
        role: genie-network-admission-controller
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      - key: node.kubernetes.io/not-ready
        effect: NoSchedule
        operator: Exists
      - key: CriticalAddonsOnly
        operator: Exists
      nodeSelector:
        node-role.kubernetes.io/master: ""
      hostNetwork: true
      serviceAccountName: genie-plugin
      containers:
        - name: genie-network-admission-controller
          image: quay.io/huawei-cni-genie/genie-admission-controller:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 8000

from cni-genie.

I assume you're trying to use this one? Take a look at correct deployment manifests here.

I don't know we should deploy genie-network-admission-controller on worker nodes.

from cni-genie.

Thanks for the pointer. Sorry for my typos - I meant to say "So you removed that DaemonSet altogether and it still works?" If it is targeting the master and does not do anything is it safe to remove it? - David

from cni-genie.

Sorry for the delayed response. We have genie-network-admission-controller daemonset. But it doesn't have any running pods, since it's targeting master nodes. I think it's probably safe to remove that daemonset.

from cni-genie.