simplify design: call CNI over prestart and poststop hook

这个 PR 简化了之前的设计, 最核心的变化直接看修改后的 oci spec.

先看之前的修改:

{
    "namespaces": [
      {
        "type": "network",
        "path": "/var/run/netns/0bc7363cd047"
      }
    ],

  "hooks": {
    "poststop": [
      {
        "path": "/bin/bash",
        "args": [
          "bash",
          "-c",
          "/opt/cni/bin/calico  <<<'{\"name\":\"calico\",\"cniVersion\":\"0.3.0\",\"type\":\"calico\",\"log_level\":\"INFO\",\"etcd_endpoints\":\"http://127.0.0.1:2379\",\"log_file_path\":\"/var/log/calico/cni/cni.log\",\"ipam\":{\"type\":\"calico-ipam\"}}'"
        ],
        "env": [
          "CNI_COMMAND=DEL",
          "CNI_CONTAINERID=0bc7363cd04749ea9544cd8ac7d23949a71b6205d7376619fb3e95bd80dd8df1",
          "CNI_NETNS=/var/run/netns/0bc7363cd047",
          "CNI_IFNAME=eth0",
          "CNI_PATH=/opt/cni/bin/",
          "CNI_ARGS=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin;HOSTNAME=0bc7363cd047;TERM=xterm;_BASH_VERSION=5.1.4;_BASH_BASELINE=5.1;_BASH_LATEST_PATCH=4"
        ]
      },
      {
        "path": "/bin/bash",
        "args": [
          "bash",
          "-c",
          "ip net d 0bc7363cd047"
        ]
      }
    ]
  },
}

可以看到之前的 oci spec 是注入了一个旁路 netns, 然后 prestart hook 没有修改, poststop hook 需要删除 netns.

而这个 pr 修改成了这样:

{
  "hooks": {
    "prestart": [
      {
        "path": "/usr/bin/docker-cni",
        "args": [
          "/usr/bin/docker-cni",
          "cni",
          "--cni",
          "/opt/cni/bin/calico",
          "--cni-config",
          "/etc/cni/net.d/10-calico.conf"
        ],
        "env": [
          "CNI_IFNAME=eth0",
          "CNI_PATH=/opt/cni/bin/",
          "CNI_COMMAND=ADD"
        ]
      }
    ],
    "poststop": [
      {
        "path": "/usr/bin/docker-cni",
        "args": [
          "/usr/bin/docker-cni",
          "cni",
          "--cni",
          "/opt/cni/bin/calico",
          "--cni-config",
          "/etc/cni/net.d/10-calico.conf"
        ],
        "env": [
          "CNI_IFNAME=eth0",
          "CNI_PATH=/opt/cni/bin/",
          "CNI_COMMAND=DEL"
        ]
      }
    ]
  },
}

新设计里不再需要旁路 netns , 并且完全把 CNI 调用移交给 hook, 简化了大量代码, 减少了大量处理事务的代码.

projecteru2 / docker-cni

simplify design: call CNI over prestart and poststop hook #5