feat(kubernetes): add cni-sidecar supervisor topology - #2606

Open

russellb wants to merge 27 commits into

NVIDIA:mainfrom

russellb:feat/kubernetes-cni-sidecar-topology

Commits on Aug 18, 2026

feat(kubernetes): add cni-sidecar supervisor topology

TaylorMutch
authored and
russellb
committed
4d784e6
docs(cni): design for cni-sidecar on OpenShift Multus
russellb
committed
ef46cfe
feat(cni): add multus-chain install mode for OpenShift
russellb
committed
915926a
feat(cni): add gated privileged SCC for OpenShift
russellb
committed
9b2bf62
feat(helm): add OpenShift cni-sidecar values overlay
russellb
committed
786944a
docs(cni): document OpenShift multus-chain mode
russellb
committed
03d9df2
fix(cni): scope privileged SCC to a dedicated CNI service account
russellb
committed
9182e7e
feat(helm): add minimal sandbox SCC for OpenShift binary-aware policy
russellb
committed
f3308fc
docs(rfc): propose cni-sidecar supervisor topology
russellb
committed
90954b0
docs(rfc): link topology PRs in cni-sidecar RFC
russellb
committed
1a99d8b
fix(cni-sidecar): address review findings for OpenShift topology
russellb
committed
1bac677
fix(cni-sidecar): close egress-enforcement gaps from re-review
russellb
committed
8032844
fix(cni-sidecar): harden readiness lifecycle, init, and IPv6 detection
russellb
committed
3c9d7c4
fix(cni-sidecar): make the CNI installer a cluster singleton
russellb
committed
d7b0753
fix(cni-sidecar): drop brittle owner guard, upgrade any openshell-cni entry in place
russellb
committed
ee3beb9
fix(cni-sidecar): harden sidecar init, scope API lookups, gate reboots
russellb
committed
888147d
docs(cni-sidecar): correct multi-release workflow, boot-taint, and singleton docs
russellb
committed
664eed6
feat(cni-sidecar): auto-aggregate sandbox namespaces into the CNI allowlist
russellb
committed
82ef0f2
feat(cni-sidecar): Helm-owned registration marker + wait-for-ack gate
russellb
committed
5eb5a46
fix(cni): harden cni-sidecar egress enforcement
russellb
committed
dbb609f
fix(cni): correct k3s CNI bin path and stale registration docs
russellb
committed
f7e9052
chore: stop tracking docs/superpowers scratch dir
russellb
committed
caf6b6b
feat(cni): standalone CNI-only install mode for independent lifecycle
russellb
committed
5c30b3a
docs(cni): point OpenShift multi-gateway guidance at standalone CNI
russellb
committed
5f02d0d
fix(cni): review fixes + fail-closed contract-version gate
russellb
committed
85a1c16
docs(rfc): cover CNI contract versioning for mixed-version clusters
russellb
committed
009bf0a
fix(cni): handle CniSidecar in upstream-proxy-auth secret mode
russellb
committed
cb6fd5f

Navigation Menu

Uh oh!

feat(kubernetes): add cni-sidecar supervisor topology - #2606

feat(kubernetes): add cni-sidecar supervisor topology#2606
russellb wants to merge 27 commits into
NVIDIA:mainfrom
russellb:feat/kubernetes-cni-sidecar-topology

Commits on Aug 18, 2026

feat(kubernetes): add cni-sidecar supervisor topology

docs(cni): design for cni-sidecar on OpenShift Multus

feat(cni): add multus-chain install mode for OpenShift

feat(cni): add gated privileged SCC for OpenShift

feat(helm): add OpenShift cni-sidecar values overlay

docs(cni): document OpenShift multus-chain mode

fix(cni): scope privileged SCC to a dedicated CNI service account

feat(helm): add minimal sandbox SCC for OpenShift binary-aware policy

docs(rfc): propose cni-sidecar supervisor topology

docs(rfc): link topology PRs in cni-sidecar RFC

fix(cni-sidecar): address review findings for OpenShift topology

fix(cni-sidecar): close egress-enforcement gaps from re-review

fix(cni-sidecar): harden readiness lifecycle, init, and IPv6 detection

fix(cni-sidecar): make the CNI installer a cluster singleton

fix(cni-sidecar): drop brittle owner guard, upgrade any openshell-cni entry in place

fix(cni-sidecar): harden sidecar init, scope API lookups, gate reboots

docs(cni-sidecar): correct multi-release workflow, boot-taint, and singleton docs

feat(cni-sidecar): auto-aggregate sandbox namespaces into the CNI allowlist

feat(cni-sidecar): Helm-owned registration marker + wait-for-ack gate

fix(cni): harden cni-sidecar egress enforcement

fix(cni): correct k3s CNI bin path and stale registration docs

chore: stop tracking docs/superpowers scratch dir

feat(cni): standalone CNI-only install mode for independent lifecycle

docs(cni): point OpenShift multi-gateway guidance at standalone CNI

fix(cni): review fixes + fail-closed contract-version gate

docs(rfc): cover CNI contract versioning for mixed-version clusters

fix(cni): handle CniSidecar in upstream-proxy-auth secret mode