Why?
When trying to enable CNI chaining mode: portmap for our kops cluster, setting spec.networking.cilium.chainingMode: "portmap" breaks pod sandbox creation entirely: kubelet fails with failed to find plugin "portmap" in path [/opt/cni/bin]. Cilium's ConfigMap correctly tells the agent to chain to the portmap plugin (for HostPort support), but nothing ever installs that binary onto the node — Cluster.InstallCNIAssets() treats any Cilium configuration as not needing the standard CNI plugins bundle, without checking whether chaining is actually in use.
What?
We tried to modifyInstallCNIAssets() now installs the standard CNI plugins bundle (bridge, host-local, loopback, portmap, etc.) whenever Cilium's ChainingMode is set to anything other than ""/"none". The default, non-chained Cilium setup is unaffected — Cilium remains self-contained there.
How?
pkg/apis/kops/cluster.go: InstallCNIAssets() special-cases Cilium and checks ChainingMode instead of just nil-checking Cilium. Added TestCluster_InstallCNIAssets in cluster_test.go covering AmazonVPC, Calico, and Cilium with no/none/portmap chaining modes.
Why?
When trying to enable CNI chaining mode: portmap for our kops cluster, setting
spec.networking.cilium.chainingMode: "portmap"breaks pod sandbox creation entirely: kubelet fails withfailed to find plugin "portmap" in path [/opt/cni/bin]. Cilium's ConfigMap correctly tells the agent to chain to the portmap plugin (for HostPort support), but nothing ever installs that binary onto the node —Cluster.InstallCNIAssets()treats any Cilium configuration as not needing the standard CNI plugins bundle, without checking whether chaining is actually in use.What?
We tried to modify
InstallCNIAssets()now installs the standard CNI plugins bundle (bridge, host-local, loopback, portmap, etc.) whenever Cilium'sChainingModeis set to anything other than""/"none". The default, non-chained Cilium setup is unaffected — Cilium remains self-contained there.How?
pkg/apis/kops/cluster.go:InstallCNIAssets()special-cases Cilium and checksChainingModeinstead of just nil-checkingCilium. AddedTestCluster_InstallCNIAssetsincluster_test.gocovering AmazonVPC, Calico, and Cilium with no/none/portmap chaining modes.