Merge pull request #255 from datum-cloud/fix/cni-stdin-tty-hang

fix(cni): avoid hang on empty stdin, log CNI config in debug mode

Author: privateip

cmd/galactic-cni/main.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/containernetworking/cni/pkg/version"
 	"github.com/spf13/cobra"
+	"golang.org/x/term"
 
 	"go.datum.net/galactic/internal/cni"
 	"go.datum.net/galactic/internal/installer"
@@ -93,6 +94,18 @@ func newRootCommand() *cobra.Command {
 				return version.All.Encode(os.Stdout)
 			}
 
+			// Real CNI runtimes (containerd, CRI-O) always pipe the network
+			// config JSON on stdin and close it. If stdin is an interactive
+			// terminal instead, no config will ever arrive, and both skel's
+			// blocking stdin read and the io.ReadAll below would hang
+			// forever. Detect that case up front and print version info
+			// rather than hanging.
+			if term.IsTerminal(int(os.Stdin.Fd())) {
+				fmt.Printf("galactic-cni version %s\n", metadata.Version)
+				fmt.Printf("CNI protocol versions supported: %s\n", strings.Join(version.All.SupportedVersions(), ", "))
+				return nil
+			}
+
 			// Read stdin once so we can inspect the CNI config before the
 			// library runs its netns validation. We pipe the buffered bytes
 			// back as os.Stdin so the CNI library can still read them.

docs/cni/configuration.md

@@ -4,7 +4,7 @@
 (or any CNI manager), plus node-local settings resolved at runtime from the
 conflist, environment variables, and (as a last resort) the Kubernetes API.
 
-> Last verified: 2026-07-16 against the current working tree of `internal/cni/config.go`
+> Last verified: 2026-07-24 against the current working tree of `internal/cni/config.go`
 > and `internal/installer/installer.go`.
 
 ## Runtime Configuration
@@ -102,7 +102,11 @@ the standard CNI `PluginConf` with Galactic-specific fields.
 | `ipam`           | No*      | `IPAM`          | IP address management configuration (see IPAM sub-fields below). *Required unless `GALACTIC_CNI_ENABLE_LOCAL_IPAM` is set — applies identically in `veth` and `tap` mode. In `tap` mode `cmdAdd` (`internal/cni/ops_add.go`) calls `allocateIPAM` unconditionally (unlike `veth` mode, which checks first), so omitting both `ipam` and `GALACTIC_CNI_ENABLE_LOCAL_IPAM` currently produces a nil-pointer panic in `tap` mode rather than a clean validation error — always set one or the other for tap. |
 
 Standard CNI fields (`cniVersion`, `name`, `dns`, `runtimeConfig`) are also
-supported via the embedded `types.PluginConf`.
+supported via the embedded `types.PluginConf`. `galactic-cni` declares support
+for the full CNI spec range (`version.All`, from `github.com/containernetworking/cni`
+v1.3.0 in `go.mod`) and returns CNI Result `1.0.0` (`type100`); generated
+configs (the installer's default conflist, Multus `NetworkAttachmentDefinition`
+manifests) use `"cniVersion": "1.0.0"`.
 
 ### Interface Types
 
@@ -176,7 +180,7 @@ entry. Deleted in `cmdDel` in reverse order.
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "1.0.0",
   "name": "galactic",
   "type": "galactic-cni",
   "vpc": "1",
@@ -193,7 +197,7 @@ from the built-in pool.
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "1.0.0",
   "name": "testvpc",
   "type": "galactic-cni",
   "vpc": "10",
@@ -212,7 +216,7 @@ from the built-in pool.
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "1.0.0",
   "name": "galactic",
   "type": "galactic-cni",
   "vpc": "1",
@@ -228,7 +232,7 @@ from the built-in pool.
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "1.0.0",
   "name": "galactic",
   "type": "galactic-cni",
   "vpc": "1",
@@ -251,7 +255,7 @@ a link-local route via the host-side device.
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "1.0.0",
   "name": "galactic-tap",
   "type": "galactic-cni",
   "vpc": "1",

go.mod

@@ -15,6 +15,7 @@ require (
 	github.com/vishvananda/netlink v1.3.2-0.20260629151558-4e35dc940f49
 	go.datum.net/network v0.0.0-20260719211723-8caa91ab0b37
 	golang.org/x/sys v0.47.0
+	golang.org/x/term v0.42.0
 	google.golang.org/grpc v1.82.1
 	k8s.io/api v0.36.0
 	k8s.io/apimachinery v0.36.1
@@ -78,7 +79,6 @@ require (
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/term v0.42.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/tools v0.43.0 // indirect

go.sum

@@ -166,8 +166,6 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-go.datum.net/network v0.0.0-20260712201947-fb4e1e9705ba h1:6Ve/ao36q85Z5dLt7xHmozvQK67zuxs6p2byWWjsrcY=
-go.datum.net/network v0.0.0-20260712201947-fb4e1e9705ba/go.mod h1:dqzM8WZczbiZ9bCvsxjkoI10GJqQ24NVWnc9boXgOkE=
 go.datum.net/network v0.0.0-20260719211723-8caa91ab0b37 h1:KldPQuababwYJyw3KToFIPaIfKyjMYbBLE9kTHVtBNM=
 go.datum.net/network v0.0.0-20260719211723-8caa91ab0b37/go.mod h1:dqzM8WZczbiZ9bCvsxjkoI10GJqQ24NVWnc9boXgOkE=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -212,8 +210,6 @@ golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
@@ -235,8 +231,6 @@ gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
-google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
 google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=

internal/cni/config.go

@@ -387,6 +387,7 @@ func parseConf(data []byte) (*PluginConf, error) {
 
 	// Setup Logging
 	setupLogging(cniConfig.LogFile, cniConfig.LogLevel)
+	slog.Debug("CNI config received", "stdin", string(data))
 
 	// Resolve local IPAM flag
 	enableLocalIPAM = config.CNIGetEnableLocalIPAM()

internal/cni/ops_check.go

@@ -110,6 +110,7 @@ func cmdStatus(args *skel.CmdArgs) error {
 
 	// Setup Logging
 	setupLogging(cniConfig.LogFile, cniConfig.LogLevel)
+	slog.Debug("CNI config received", "stdin", string(args.StdinData))
 
 	// Config is parseable and API server is reachable.
 	slog.Info("STATUS: probing API server reachability")