feat(kubernetes): add cni-sidecar supervisor topology - #2606

Open

russellb wants to merge 20 commits into

NVIDIA:mainfrom

russellb:feat/kubernetes-cni-sidecar-topology

Commits on Aug 11, 2026

feat(kubernetes): add cni-sidecar supervisor topology

TaylorMutch
authored and
russellb
committed
6ea092d
docs(cni): design for cni-sidecar on OpenShift Multus
russellb
committed
d605add
feat(cni): add multus-chain install mode for OpenShift
russellb
committed
8de6bcd
feat(cni): add gated privileged SCC for OpenShift
russellb
committed
97af6c7
feat(helm): add OpenShift cni-sidecar values overlay
russellb
committed
e22104b
docs(cni): document OpenShift multus-chain mode
russellb
committed
32fa0ca
fix(cni): scope privileged SCC to a dedicated CNI service account
russellb
committed
74b6121
feat(helm): add minimal sandbox SCC for OpenShift binary-aware policy
russellb
committed
697fce2
docs(rfc): propose cni-sidecar supervisor topology
russellb
committed
27fce71
docs(rfc): link topology PRs in cni-sidecar RFC
russellb
committed
456cad2
fix(cni-sidecar): address review findings for OpenShift topology
russellb
committed
4b37543
fix(cni-sidecar): close egress-enforcement gaps from re-review
russellb
committed
9580256
fix(cni-sidecar): harden readiness lifecycle, init, and IPv6 detection
russellb
committed
a266675
fix(cni-sidecar): make the CNI installer a cluster singleton
russellb
committed
a58399f
fix(cni-sidecar): drop brittle owner guard, upgrade any openshell-cni entry in place
russellb
committed
449465a
fix(cni-sidecar): harden sidecar init, scope API lookups, gate reboots
russellb
committed
5f214c2
docs(cni-sidecar): correct multi-release workflow, boot-taint, and singleton docs
russellb
committed
78dfd34
feat(cni-sidecar): auto-aggregate sandbox namespaces into the CNI allowlist
russellb
committed
bcd4f8f
feat(cni-sidecar): Helm-owned registration marker + wait-for-ack gate
russellb
committed
daa8d51
fix(cni): harden cni-sidecar egress enforcement
russellb
committed
c4c8a85

Navigation Menu

Uh oh!

feat(kubernetes): add cni-sidecar supervisor topology - #2606

feat(kubernetes): add cni-sidecar supervisor topology#2606
russellb wants to merge 20 commits into
NVIDIA:mainfrom
russellb:feat/kubernetes-cni-sidecar-topology

Commits on Aug 11, 2026

feat(kubernetes): add cni-sidecar supervisor topology

docs(cni): design for cni-sidecar on OpenShift Multus

feat(cni): add multus-chain install mode for OpenShift

feat(cni): add gated privileged SCC for OpenShift

feat(helm): add OpenShift cni-sidecar values overlay

docs(cni): document OpenShift multus-chain mode

fix(cni): scope privileged SCC to a dedicated CNI service account

feat(helm): add minimal sandbox SCC for OpenShift binary-aware policy

docs(rfc): propose cni-sidecar supervisor topology

docs(rfc): link topology PRs in cni-sidecar RFC

fix(cni-sidecar): address review findings for OpenShift topology

fix(cni-sidecar): close egress-enforcement gaps from re-review

fix(cni-sidecar): harden readiness lifecycle, init, and IPv6 detection

fix(cni-sidecar): make the CNI installer a cluster singleton

fix(cni-sidecar): drop brittle owner guard, upgrade any openshell-cni entry in place

fix(cni-sidecar): harden sidecar init, scope API lookups, gate reboots

docs(cni-sidecar): correct multi-release workflow, boot-taint, and singleton docs

feat(cni-sidecar): auto-aggregate sandbox namespaces into the CNI allowlist

feat(cni-sidecar): Helm-owned registration marker + wait-for-ack gate

fix(cni): harden cni-sidecar egress enforcement