Configure a filter for ENIs - Container Service for Kubernetes

In Terway mode, Terway manages node ENIs by default. If you need to manage some ENIs yourself, configure a tag filter so Terway manages only ENIs that match the filter and avoids conflicts. This topic explains how to configure an ENI filter for Terway.

Prerequisites

An ACK managed cluster with the Terway network plug-in is created.
Target ENIs are configured with the required tags. Terway skips untagged ENIs.

Warning

High-risk operation. Do not proceed until you fully understand and verify all steps.

Limitations

Terway 1.5.5 or later is required. See Manage components to upgrade.
Supported on ECS nodes only, not Lingjun nodes.

Procedure

Modify the Terway configuration file.

kubectl edit cm -n kube-system eni-config

In eni_conf, add the tag filter.
```
 "eni_tag_filter":  { "creator": "terway" }
```
"eni_tag_filter" specifies a tag filter. In this example, { "creator": "terway" } instructs Terway to manage only ENIs with this tag.

Example:
```
 eni_conf: |
    {
      "eni_tag_filter":  { "creator": "terway" },
      "ip_stack": "ipv4",
      "vswitch_selection_policy": "ordered"
     }
```
Important
Ensure target ENIs have the expected tags. Untagged ENIs are excluded from Terway management.

See Manage ENIs by using tags.

To auto-tag ENIs on creation, see Customize Terway parameters.

Restart Terway to apply the configuration.

kubectl delete pod -nkube-system -l app=terway-eniip

Expected output:

pod "terway-eniip-XXX" deleted

Verify the configuration is applied.

Check terway-eniip pod status.

kubectl get pods -n kube-system -l app=terway-eniip

Expected output:

NAME                 READY   STATUS    RESTARTS   AGE
terway-eniip-XXX   2/2     Running   0          19h

View the Terway configuration.

kubectl logs -nkube-system terway-eniip-XXX
# Or
kubectl logs -nkube-system terway-eniip-XXX -c terway-init

If the output includes the following, the configuration is applied:

# ENITagFilter specifies the network interface tag filter. creator:terway matches only the network interfaces created by Terway.
ENITagFilter:map[creator:terway]

Add a new node or re-add an existing one to apply the configuration.