Cluster requirements

What a cluster needs to run Lace. The data plane is eBPF and SRv6, so the requirements are mostly about the nodes and the network between them.

Nodes

• Linux, amd64 or arm64. The node DaemonSet only schedules onto kubernetes.io/os: linux.
• A recent kernel with the features the data plane relies on:
  • eBPF with TC (clsact) attachment — every program hooks at TC ingress,
  • SRv6 (seg6) encapsulation and decapsulation,
  • a BPF filesystem at /sys/fs/bpf for pinned maps.
  • Developed and tested on Ubuntu 24.04 (kernel 6.8); older kernels may lack the required SRv6 behaviour.
• Privileges — the node agent runs as a privileged, hostNetwork DaemonSet and mounts host paths: the CNI binary and config directories, /sys/fs/bpf, /var/run/netns, and /sys/fs/cgroup. A PodSecurity policy must allow this.

Underlay

Cross-node traffic is carried by SRv6 over the underlay (the physical network between nodes).

• IPv6 reachability between nodes is required — locators and SIDs are IPv6, regardless of whether the overlays use IPv4, IPv6, or both.
• Only L3 (routed) reachability is needed in principle. Lace installs locator routes only between nodes that are on-link (same L2 segment), so those work out of the box. Nodes reachable only through a router fall back to the node’s default (or a custom) route — for those you must make the underlay aware of each node’s locator prefix and manage the routing yourself. Lace does not yet advertise locators (no BGP) and does not control which node gets which prefix.

See Data plane for how the underlay is used.

Cluster

• No other CNI plugin — Lace is the cluster’s CNI.
• An IPv6 prefix to assign per-node SRv6 locators from, set as controller.srv6LocatorPrefix at install time. Without it, nodes cannot be addressed on the underlay and cross-node traffic fails.