How do I configure a whitelist for ENIs? - Container Service for Kubernetes

In Terway network mode, Terway manages the elastic network interfaces (ENIs) on your nodes. If a special scenario requires you to manage some ENIs yourself, configure a whitelist so that Terway manages only the ENIs that match the tag filter. This avoids conflicts between the two sets of ENIs.

Prerequisites

An ACK managed cluster is created, and the network plugin of the cluster is Terway.
The expected tags are configured on the ENIs. Otherwise, these ENIs are excluded.

Warning

This topic contains high-risk operations. Proceed only after you fully understand and verify them.

Limits

Terway must be v1.5.5 or later (v1.17.7 or later to use the ENI tag filter). For more information about how to upgrade Terway, see Components.
The ENI whitelist is supported only on ECS nodes. Lingjun nodes are not supported.

Important

Due to an ECS API limit, earlier versions of Terway may intermittently fail to query ENIs that have specific tags. This issue is fixed in v1.17.7. To use this feature, upgrade Terway to v1.17.7 or later.

Procedure

Modify the Terway configuration file.

kubectl edit cm -n kube-system eni-config

Add the following content to the eni_conf configuration.
```
 "eni_tag_filter":  { "creator": "terway" }
```
"eni_tag_filter" specifies the ENI tag filter, and { "creator": "terway" } specifies the tag filter conditions, which means that only the ENIs created by Terway are matched.

Example:
```
 eni_conf: |
    {
      "eni_tag_filter":  { "creator": "terway" },
      "ip_stack": "ipv4",
      "vswitch_selection_policy": "ordered"
     }
```
Important
Make sure that the expected tags are configured on the ENIs. Otherwise, these ENIs are excluded.

For more information about how to modify ENI tags, see Modify the tags of an ENI.

For more information about how to configure Terway to tag ENIs when it creates them, see Customize Terway configuration parameters.

Restart Terway to apply the configuration.

kubectl delete pod -nkube-system -l app=terway-eniip

Expected output:

pod "terway-eniip-XXX" deleted

Verify that the configuration takes effect.

Check the status of terway-eniip.

kubectl get pods -n kube-system -l app=terway-eniip

Expected output:

NAME                 READY   STATUS    RESTARTS   AGE
terway-eniip-XXX   2/2     Running   0          19h

View the Terway configuration.

kubectl logs -nkube-system terway-eniip-XXX
or
kubectl logs -nkube-system terway-eniip-XXX -c terway-init

If the output contains content similar to the following, the Terway configuration has taken effect:

# ENITagFilter indicates the ENI tag filter, and creator:terway indicates that only the ENIs created by Terway are matched.
ENITagFilter:map[creator:terway]

Add a new node or re-add an existing node to apply the configuration.