ci: provide a CNI config for the e2e tests - #978
Merged
cmainas merged 2 commits intoAug 17, 2026
Conversation
Added a bridge network config with a gateway and a default route, so that the host can reach the pod with portmap for port mappings and firewall for the forwarding rules. The file name sorts before config that nerdctl generates since the CRI plugin loads only the first one. Also wait for the CRI network to report ready before running tests to add clear log messages instead of failing tests. Fixes: urunc-dev#967 Signed-off-by: Odysseas Kalaitsidis <odysseaskalaitsides@gmail.com>
The readiness check needs jq, which so far was only there because the runner image happened to provide it. It also retries on errors now, so that it does not fail while containerd is restarting. Signed-off-by: Odysseas Kalaitsidis <odysseaskalaitsides@gmail.com>
✅ Deploy Preview for urunc ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
OdysseasKalaitsidis
force-pushed
the
fix/ci-cni-conf
branch
from
August 16, 2026 12:04
84953c3 to
afe4cd8
Compare
OdysseasKalaitsidis
changed the title
cmainas
approved these changes
Aug 17, 2026
cmainas
left a comment
cmainas
left a comment
Contributor
There was a problem hiding this comment.
Thank you @OdysseasKalaitsidis for the fix.
github-actions Bot
pushed a commit
that referenced
this pull request
Aug 17, 2026
Added a bridge network config with a gateway and a default route, so that the host can reach the pod with portmap for port mappings and firewall for the forwarding rules. The file name sorts before config that nerdctl generates since the CRI plugin loads only the first one. Also wait for the CRI network to report ready before running tests to add clear log messages instead of failing tests. PR: #978 Fixes: #967 Signed-off-by: Odysseas Kalaitsidis <odysseaskalaitsides@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
github-actions Bot
pushed a commit
that referenced
this pull request
Aug 17, 2026
The readiness check needs jq, which so far was only there because the runner image happened to provide it. It also retries on errors now, so that it does not fail while containerd is restarting. PR: #978 Signed-off-by: Odysseas Kalaitsidis <odysseaskalaitsides@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
urunc-bot Bot
pushed a commit
that referenced
this pull request
Aug 17, 2026
Added a bridge network config with a gateway and a default route, so that the host can reach the pod with portmap for port mappings and firewall for the forwarding rules. The file name sorts before config that nerdctl generates since the CRI plugin loads only the first one. Also wait for the CRI network to report ready before running tests to add clear log messages instead of failing tests. PR: #978 Fixes: #967 Signed-off-by: Odysseas Kalaitsidis <odysseaskalaitsides@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
urunc-bot Bot
pushed a commit
that referenced
this pull request
Aug 17, 2026
The readiness check needs jq, which so far was only there because the runner image happened to provide it. It also retries on errors now, so that it does not fail while containerd is restarting. PR: #978 Signed-off-by: Odysseas Kalaitsidis <odysseaskalaitsides@gmail.com> Reviewed-by: Charalampos Mainas <cmainas@nubificus.co.uk> Approved-by: Charalampos Mainas <cmainas@nubificus.co.uk>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The workflow installs the CNI plugin binaries in
/opt/cni/bin, but never writes a config in/etc/cni/net.d. containerd needs both, so with an empty conf dir the CRI plugin has no network to attach a pod to and every pod creation fails withcni plugin not initialized.Until now that config came from the runner image, which used to ship podman's
87-podman-bridge.conflist. Newer images no longer install it and the crictl tests started failing. Only crictl is affected, since nerdctl generates its own config and the ctr and docker jobs do not use CRI networking.So the workflow now writes its own config a bridge on
10.88.0.0/16with a gateway and a default route, plus portmap and firewall, which is the same shape as the one we were getting from the image. It also waits for the CRI network to report ready before the tests, so a similar break fails with a clear message instead of a list of failing tests, and it installsjq, which that check needs.Related issues
Fixes #967
How was this tested?
Locally on arm64 and amd64, in Ubuntu 22.04 machines with systemd and the versions we pin in
ci.yml. With an empty conf dir I get the samecni plugin not initializederror as CI. With the config, the network reports ready, the pod gets10.88.0.2and pinging it from the host works, which is whatpingTestdoes.I also checked that CRI picks our file over the one nerdctl generates, and that the firewall plugin matters when the
FORWARDpolicy isDROPas Docker sets it on the runners: pod egress works with it and is blocked without it.Finally I built urunc and solo5-spt in the same machine and ran the Spt specs that do not need devmapper, 2 Passed and 0 Failed
.Spt-mirage-net` is the one that pings the unikernel through CRI, so that is the failing path covered. The devmapper specs and the monitors that need KVM are left to CI.LLM usage
I used Claude (Opus 5) to help investigate the runner image change and draft the workflow steps. I reviewed everything and I am responsible for the result.
Checklist
make lint).make test_ctr,make test_nerdctl,make test_docker,make test_crictl).