Installation

Lace ships two Helm charts, published at the same version on every release. Check the cluster requirements first.

• lace-cni — the plugin itself: CRDs, controller, node agent. Always the same install, no configuration required beyond the SRv6 locator prefix.
• lace-cni-networks — optional, a default cluster networking configuration expressed as Networks and policies. It makes a fresh cluster work out of the box; skip it to define your own topology from scratch.

Install

helm install lace oci://ghcr.io/squ94wk/charts/lace-cni \
  --namespace kube-system \
  --set controller.srv6LocatorPrefix=2001:db8:100::/48

helm install lace-networks oci://ghcr.io/squ94wk/charts/lace-cni-networks \
  --namespace kube-system

The image and both charts are published multi-arch for amd64 and arm64.

The plugin chart deploys:

• the CRDs,
• the controller as a single-replica Deployment,
• the node agent as a DaemonSet on every Linux node, which also installs the CNI plugin onto the host,
• RBAC and a ValidatingAdmissionPolicy.

Until a Network exists and a binding policy matches them, pods get no addresses — that is what the networks chart provides.

Plugin values

Value	Default	Description
controller.srv6LocatorPrefix	""	IPv6 prefix per-node SRv6 locators are carved from. Required for cross-node traffic; keep it short enough for one locator per node plus the 32 bits reserved for the SID function and arguments.
image.repository	ghcr.io/squ94wk/lace-cni	Controller and node image.
image.tag	chart appVersion	Image tag to pull.
node.apiserverAddress	""	Address of the API server. When empty, Helm looks it up from the default/kubernetes EndpointSlice at install/upgrade time and bakes the result into the manifest; set it explicitly if that lookup is wrong or the address can change.
node.kubeletCgroupPath	/sys/fs/cgroup/system.slice/kubelet.service	Cgroup whose processes may reach local pods’ probe endpoints.
node.releasePinnedMaps	false	Remove previously pinned BPF maps on startup, forcing fresh map creation. Briefly disruptive to data plane traffic while maps are rebuilt.
cni.binDir	/opt/cni/bin	Host directory the CNI plugin binary is written to.
cni.confDir	/etc/cni/net.d	Host directory the CNI config is written to.
cni.confName	10-lace.conflist	CNI config filename.

Match the CNI host paths to the node’s runtime.

Networks values

Value	Default	Description
systemNetwork.enabled	true	Install the system Network (see below).
defaultNetwork.enabled	true	Install the default Network (see below).
internetNetwork.enabled	true	Install the internet Network (see below).
kubernetesServiceRouting.enabled	true	Let the system Network reach the default/kubernetes Service on the internet Network.
internetRouting.enabled	false	Let the default Network reach arbitrary external destinations through the internet Network, masquerading egress behind the node’s address.
extraRoutingPolicies	{}	Additional routing policies, keyed by name: matchKind lists pod (route a Network to a Network) and/or service (route a Network to Services); the remaining keys are the policy spec.

Each Network also exposes name, priority, and subnet/prefix values, so it can be disabled or re-addressed:

• systemNetwork — binds kube-system pods to a dedicated Network at highest precedence so cluster system pods always have shared connectivity.
• defaultNetwork — a catch-all for pods no binding policy matches; it has no route to itself, so such pods reach only networks they are explicitly peered with. Enable internetRouting to peer it to the internet Network, so its pods reach the outside world.
• internetNetwork — an external Network covering everything outside the cluster, with the default/kubernetes Service bound to it. Binding the Service does not make the API server reachable on its own; a ServiceRoutingPolicy or NetworkRoutingPolicy is still needed, and traffic to it then uses host routing. kubernetesServiceRouting adds that routing for the system Network; internetRouting peers the default Network to it for general egress.

Upgrade

helm upgrade lace oci://ghcr.io/squ94wk/charts/lace-cni \
  --namespace kube-system --reuse-values

helm upgrade lace-networks oci://ghcr.io/squ94wk/charts/lace-cni-networks \
  --namespace kube-system --reuse-values

Upgrade both charts to the same version. The CRDs are templated rather than shipped in the chart’s crds/ directory, so helm upgrade of the plugin chart applies their new versions. The node DaemonSet rolls one node at a time; the controller Deployment uses a Recreate strategy, so the single replica is replaced rather than run in parallel.

Uninstall

helm uninstall lace-networks --namespace kube-system
helm uninstall lace --namespace kube-system

Uninstalling the plugin chart deletes the CRDs, which removes all Networks and the internal resources derived from them.

What is left behind on each node until it is rebooted or cleaned by hand:

• the CNI plugin binary and config file in the host CNI directories,
• pinned BPF maps under /sys/fs/bpf,
• the interfaces Lace built for its networks.

Running pods keep their existing connectivity until they are recreated, since their data plane state lives in those leftover maps and interfaces.