config based network setup: any doc?

[rtgiskard]

just like cni-plugins, does netavark support config based network setup?

• what I have found
  . plugin api
  . any doc with more details?

• what I'm confused
  . what's the standard full config for a network definition
  . where do I save the config

• further more
  . netavark have implemented firewall bakend selection based on env (issue), may I define it with the config?
  . cni-plugins config spec reference as an example

[Luap99]

The plugins use the regular network config that podman uses.

You should not have to handle config files directly with the plugin API you can create the network with podman network crate --driver <plugin> ...

[rtgiskard]

when I switch the network backend from cni-plugins to netavark, and then create network with podman network create ..., I find that the default network is configed from the main /etc/containers/containers.conf only, and the second network to be created will be saved to /etc/containers/networks/net_name.json, for example:

$ podman network ls
NETWORK ID    NAME        DRIVER
2f259bab93aa  podman      bridge

 $ podman network create net_2ed
net_2ed

 $ podman network ls
NETWORK ID    NAME        DRIVER
9425ae64ae22  net_2ed     bridge
2f259bab93aa  podman      bridge

 $ ls -l /etc/containers/networks/
total 4
-rw-r--r-- 1 root root 494 Jul 23 19:09 net_2ed.json

$ cat /etc/containers/networks/net_2ed.json 
{
     "name": "net_2ed",
     "id": "9425ae64ae22b1b1190b64be6798bad2b0288f0d8b95e8b42697b9e6fd40f9e7",
     "driver": "bridge",
     "network_interface": "podman1",
     "created": "2023-07-23T19:09:54.384416406+08:00",
     "subnets": [
          {
               "subnet": "10.89.0.0/24",
               "gateway": "10.89.0.1"
          }
     ],
     "ipv6_enabled": false,
     "internal": false,
     "dns_enabled": true,
     "ipam_options": {
          "driver": "host-local"
     }
}

The created network is not actually created on the host as an interface when it's not used. The json file seems to contains just basic network definition without extra info like firewall or etc., which that the underlying network backend may need to know.

And here is my network config with cni-plugins, for comparison:

$ podman network ls 
NETWORK ID    NAME        DRIVER
ac2fc1bdc578  cni_br0     bridge
74dce45660bf  cni_br2     bridge

$ ls -l /etc/cni/net.d/
total 8
-rw-r--r-- 1 root root   0 Jan 29 01:35 cni.lock
-rw-r--r-- 1 root root 818 Jan 22  2023 cni_br0.conflist
-rw-r--r-- 1 root root 832 Jan 22  2023 cni_br2.conflist

$ podman network inspect cni_br2 
[
     {
          "name": "cni_br2",
          "id": "74dce45660bfa22ead752f878624d2f3e548d753add073ffc053ba7f6d47b9d8",
          "driver": "bridge",
          "network_interface": "cni_br2",
          "created": "2023-01-22T02:26:02.246699861+08:00",
          "subnets": [
               {
                    "subnet": "fd00:ef:22::/64",
                    "gateway": "fd00:ef:22::1",
                    "lease_range": {
                         "start_ip": "fd00:ef:22::100",
                         "end_ip": "fd00:ef:22::200"
                    }
               }
          ],
          "ipv6_enabled": true,
          "internal": false,
          "dns_enabled": false,
          "ipam_options": {
               "driver": "host-local"
          }
     }
]

$ cat /etc/cni/net.d/cni_br2.conflist 
{
   "cniVersion": "1.0.0",
   "name": "cni_br2",
   "plugins": [
      {
         "type": "bridge",
         "bridge": "cni_br2",
         "isGateway": true,
         "ipMasq": false,
         "hairpinMode": true,
         "ipam": {
            "type": "host-local",
            "routes": [
               {
                  "dst": "fd0e:ef::1/128"
               }
            ],
            "ranges": [
               [
                  {
                     "subnet": "fd00:ef:22::/64",
                     "rangeStart": "fd00:ef:22::100",
                     "rangeEnd": "fd00:ef:22::200",
                     "gateway": "fd00:ef:22::1"
                  }
               ]
            ]
         },
         "capabilities": {
            "ips": true
         }
      },
      {
         "type": "tuning"
      }
   ]
}

As the network backend actually not only maintains a basic network interface, but also bridge the host firewall for related operations.

Generally the firewall configuration is global rather than network specific, and netavark seems to expected it to be declare in the main containers.conf, and now netavark is ready for that so long as the info passed down to it.

Well, I see, to move from cni-plugins to netavark:

$ mkdir -p /etc/containers/networks
$ cd /etc/containers/networks
$ podman inspect cni_br0 | jq '.[0]' > cni_br0.json
$ podman inspect cni_br2 | jq '.[0]' > cni_br2.json

then edit the config /etc/containers/containers.conf

[network]
network_backend="netavark"
default_network="cni_br0"

This should be enough, and now just wait conmon to pass down the related info.

If I make any mistakes, please point them out. Thank you!