Ability to customize network namespace of pods

[pcguy85]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind feature

Description

podman commands create and run provide options to customize the container's network namespace (--net, --ip, etc.). However the podman pod create command doesn't have any similar options. To my (still limited) podman knowledge the pod's network namespace configuration needs to be associated with it's infra container. Is there any way, for example, to assign a static IP address to the infra container or change the network it is connected to? Imho the ability to further customize pods' network namespace could make it easier to integrate podman with existing infrastructure.

Or is there already a way to do this? As said, my podman knowledge is still limited.

[rhatdan]

@pcguy85 Any chance you could open a PR to fix this?

[haircommander]

@rhatdan I started a fix for this but I feel like there should be larger structural changes to the infra container. We will soon end up duplicating a bunch of configuration code to set up namespaces for the infra container. I was thinking of trying to use some of the cmd/podman/shared/create code that is relevant but getting the timing and library dependencies is tricky. In other words, it's a wip :)

[baude]

@rhatdan at this point, i am wondering if a blog written explicitly on this would suffice.

[rhatdan]

@weirdwiz Could you take a look at this?

[rhatdan]

@weirdwiz Did you ever get a chance to look at this? @QiWang19 PTAL

[mheon]

Agree with @haircommander that this will probably require significant structural changes to the infra container. I would not work on this until he and I have had a chance to hash out how we want to handle that.

[haircommander]

^ yes, I don't think it make sense to continually extend the capabilities of the infra container and further duplicate container creation code. There are tons of things we can add to pod if we change the code paths in this way

[weirdwiz]

@weirdwiz Did you ever get a chance to look at this?

I wasn't able to take a look at this.

[thmo]

What is the workaround until this feature is implemented? Say, if I want to put a complete pod in a different network? (Temporarily) change the default network as configured via cni?

[vrothberg]

That's what I have in mind as well. @baude might now some nice tricks?

[github-actions]

This issue had no activity for 30 days. In the absence of activity or the "do-not-close" label, the issue will be automatically closed within 7 days.

[vrothberg]

@baude, what's your take on the issue?

[rhatdan]

I think this is a good issue, and should be something we work on and support.
@giuseppe Would you look into it?

[giuseppe]

I think we need to address pod create issues as a bigger epic.

#3993 is a similar issue.

We need to change podman create to acces the same set of options we have for run and create and apply them to the infra container.

[giuseppe]

alternatively, we could have something like podman pod create --infra-container=EXISTING_CONTAINER_ID

Where EXISTING_CONTAINER_ID is an already configured container, that is not part of any other pod.

In this way we allow even more flexibility as the container can be customized between its create and pod create

[daledude]

Being able to set the network on pod create would be very useful to us. Currently creating a container with the network and then attaching each other containers network to it seems hacky. Adding network on pod create like -P seems more logical.

[github-actions]

This issue had no activity for 30 days. In the absence of activity or the "do-not-close" label, the issue will be automatically closed within 7 days.

[vrothberg]

Friendly ping. @giuseppe, do you have cycles to pick this?

[giuseppe]

Friendly ping. @giuseppe, do you have cycles to pick this?

I think we need to unify pod create with container create, so that we can expose all the options. Unfortunately it is not a trivial amount of work :/

[mheon]

We have a partial unification in the works - I'm working up cards for it. Hopefully will have (at least network) related options exposed over the next few sprints.

[mheon]

Long-term we're moving away from an infra container, hopefully using the work @haircommander is doing for CRI-O for that purpose

[rhatdan]

@mheon is the PR you are currently working on going to help with this or do we need to wait for pinns?

[mheon]

This will be handled by my PR, I'll add a link

[mheon]

Fixed by #5241