[Draft]Add antreanodeconfig crd agent

[luolanzone]

Note

High Risk
Introduces a new beta feature with CRD changes, controller logic, and integration with secondary networks. The module path change to v2 affects the entire codebase. Changes to core agent initialization and secondary network bridge configuration could impact existing deployments.

Overview
Adds the AntreaNodeConfig CRD (beta feature, enabled by default) to enable per-Node configuration of Antrea agent settings via nodeSelector-based policies. This allows cluster administrators to apply different secondary network OVS bridge configurations to different Node pools.

Key changes:

• New CRD AntreaNodeConfig with nodeSelector matching and secondary network bridge configuration (bridge name, physical interfaces, VLAN filtering, multicast snooping).
• New controller in pkg/agent/antreanodeconfig/ that watches AntreaNodeConfig resources and publishes immutable snapshots to subscribers (e.g., secondary network controller) when the effective configuration for a Node changes.
• Secondary network integration updated to consume AntreaNodeConfig snapshots, with support for waiting on initial configuration before bridge initialization.
• Module path bumped to v2 (antrea.io/antrea/v2) across all imports for the major version release.
• Flow Aggregator multi-arch support added to build workflows (amd64, arm64, arm) with manifest list publishing.
• Test infrastructure enhanced with VLAN-aware bridge support for Kind clusters and new e2e tests for AntreaNodeConfig with label selectors.

^{Reviewed by Cursor Bugbot for commit a8f0913. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Potential deadlock with AntreaNodeConfig initialization order

High Severity

When both SecondaryNetwork and AntreaNodeConfig features are enabled, WaitForInitialANCSnapshotAndEnsureBridge is called at line 995 to wait for the first AntreaNodeConfig snapshot. However, this blocking wait occurs during the agent's initialization sequence, before many controllers have started their work. The antreaNodeConfigController.Run is started at line 882, but the subscription callback that closes ancFirstSnapshotCh (set up at lines 159-172 in secondarynetwork/init.go) requires the controller to process events and publish snapshots. If the controller's event processing is delayed or depends on other initialization steps that happen after line 995, this could cause a deadlock or extended startup delay, especially since the wait is blocking the main initialization flow.

 

^{Reviewed by Cursor Bugbot for commit 1e626ed. Configure here.}

[cursor]

Commented out trap disables cleanup on exit

High Severity

The trap "quit" INT EXIT statement is commented out, preventing cleanup from running when the script exits normally or is interrupted. This means the quit function won't execute, leaving stale Kind clusters and Docker networks that should be cleaned up. The cleanup logic is defined but never triggered.

 

^{Reviewed by Cursor Bugbot for commit ec6c54f. Configure here.}

[cursor]

Nested loop counter placement causes incorrect interface assignment

High Severity

The counter i is initialized to 1 before the inner loop but incremented inside it, causing the interface number to continue incrementing across all networks for each node instead of resetting. For example, if there are 2 networks, node1 gets eth1 and eth2, but node2 would incorrectly get eth3 and eth4 instead of eth1 and eth2. This breaks network connectivity between nodes.

 

^{Reviewed by Cursor Bugbot for commit ec6c54f. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{Reviewed by Cursor Bugbot for commit a8f0913. Configure here.}

[cursor]

Flow aggregator removed architecture-specific node selector

Low Severity

The deployment removed the kubernetes.io/arch: amd64 node selector while keeping kubernetes.io/os: linux. This change allows the flow-aggregator to schedule on non-amd64 architectures (arm64, arm), but the workflow changes suggest multi-arch images are being built. However, without verifying that all dependencies and features work correctly on non-amd64 platforms, this could lead to runtime failures.

 

^{Reviewed by Cursor Bugbot for commit a8f0913. Configure here.}