[Backport release-1.2] fix(multus): build custom image with DEL cache fix (#2314)

# Description
Backport of #2313 to `release-1.2`.

Makefile

@@ -27,6 +27,7 @@ build: build-deps
 	make -C packages/system/dashboard image
 	make -C packages/system/metallb image
 	make -C packages/system/kamaji image
+	make -C packages/system/multus image
 	make -C packages/system/bucket image
 	make -C packages/system/objectstorage-controller image
 	make -C packages/system/grafana-operator image

packages/system/multus/Makefile

@@ -11,3 +11,15 @@ update:
 	wget -q https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/refs/tags/$(RELEASE)/deployments/multus-daemonset-thick.yml -O templates/multus-daemonset-thick.yml
 	sed -i '/multus-cni/s/snapshot-thick/$(RELEASE)-thick/' templates/multus-daemonset-thick.yml && \
 	patch --no-backup-if-mismatch -p4 < patches/customize-deployment.patch
+	$(SED_INPLACE) "/ARG VERSION/ s|=.*|=$(RELEASE)|g" images/multus-cni/Dockerfile
+
+image:
+	docker buildx build images/multus-cni \
+		--tag $(REGISTRY)/multus-cni:$(call settag,$(TAG)) \
+		--cache-from type=registry,ref=$(REGISTRY)/multus-cni:latest \
+		--cache-to type=inline \
+		--metadata-file images/multus-cni.json \
+		$(BUILDX_ARGS)
+	DIGEST=$$(yq e '."containerimage.digest"' images/multus-cni.json -o json -r) && \
+		sed -i "s|image: .*multus-cni.*|image: $(REGISTRY)/multus-cni:$(TAG)@$${DIGEST}|g" templates/multus-daemonset-thick.yml
+	rm -f images/multus-cni.json

packages/system/multus/images/multus-cni/Dockerfile

@@ -0,0 +1,25 @@
+FROM --platform=$BUILDPLATFORM golang:1.24 AS build
+
+ARG VERSION=v4.2.3
+ARG TARGETPLATFORM
+
+WORKDIR /usr/src/multus-cni
+
+RUN curl -sSL https://github.com/k8snetworkplumbingwg/multus-cni/archive/refs/tags/${VERSION}.tar.gz | \
+    tar -xzf - --strip=1
+
+COPY patches /patches
+RUN git init && git config user.email "build@cozystack" && git config user.name "build" && \
+    git add -A && git commit -m "init" && git tag ${VERSION} && \
+    git apply /patches/*.diff
+
+RUN ./hack/build-go.sh
+
+FROM debian:stable-slim
+LABEL org.opencontainers.image.source=https://github.com/cozystack/cozystack
+COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin
+COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE
+COPY --from=build /usr/src/multus-cni/bin/cert-approver /
+WORKDIR /
+
+ENTRYPOINT ["/usr/src/multus-cni/bin/multus-daemon"]

packages/system/multus/images/multus-cni/patches/fix-del-without-cache.diff

@@ -0,0 +1,49 @@
+diff --git a/pkg/multus/multus.go b/pkg/multus/multus.go
+index a7941fe..eff0406 100644
+--- a/pkg/multus/multus.go
++++ b/pkg/multus/multus.go
+@@ -954,33 +954,19 @@ func CmdDel(args *skel.CmdArgs, exec invoke.Exec, kubeClient *k8s.ClientInfo) er
+ 	}
+ 
+ 	if !useCacheConf {
+-		// Fetch delegates again if cache is not exist and pod info can be read
+-		if os.IsNotExist(err) && pod != nil {
+-			if in.ClusterNetwork != "" {
+-				_, err = k8s.GetDefaultNetworks(pod, in, kubeClient, nil)
+-				if err != nil {
+-					return cmdErr(k8sArgs, "failed to get clusterNetwork/defaultNetworks: %v", err)
+-				}
+-				// First delegate is always the master plugin
+-				in.Delegates[0].MasterPlugin = true
+-			}
+-
+-			// Get pod annotation and so on
+-			_, _, err := k8s.TryLoadPodDelegates(pod, in, kubeClient, nil)
+-			if err != nil {
+-				if len(in.Delegates) == 0 {
+-					// No delegate available so send error
+-					return cmdErr(k8sArgs, "failed to get delegates: %v", err)
+-				}
+-				// Get clusterNetwork before, so continue to delete
+-				logging.Errorf("Multus: failed to get delegates: %v, but continue to delete clusterNetwork", err)
+-			}
+-		} else {
+-			// The options to continue with a delete have been exhausted (cachefile + API query didn't work)
+-			// We cannot exit with an error as this may cause a sandbox to never get deleted.
+-			logging.Errorf("Multus: failed to get the cached delegates file: %v, cannot properly delete", err)
++		// If cache does not exist, ADD was never completed for this sandbox.
++		// Attempting DEL with a config reconstructed from the API will fail because
++		// delegate plugins (e.g. kube-ovn) require runtime state that only exists
++		// after a successful ADD (socket paths, cached results, etc.).
++		// Return success to allow containerd to release the sandbox name reservation.
++		if os.IsNotExist(err) {
++			logging.Verbosef("Multus: no cache found for container %s (ADD was never completed), skip DEL", args.ContainerID)
+ 			return nil
+ 		}
++		// The options to continue with a delete have been exhausted
++		// We cannot exit with an error as this may cause a sandbox to never get deleted.
++		logging.Errorf("Multus: failed to get the cached delegates file: %v, cannot properly delete", err)
++		return nil
+ 	}
+ 
+ 	// set CNIVersion in delegate CNI config if there is no CNIVersion and multus conf have CNIVersion.

packages/system/multus/templates/multus-daemonset-thick.yml

@@ -154,7 +154,7 @@ spec:
       serviceAccountName: multus
       containers:
         - name: kube-multus
-          image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.3-thick
+          image: ghcr.io/cozystack/cozystack/multus-cni:latest@sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459
           command: [ "/usr/src/multus-cni/bin/multus-daemon" ]
           resources:
             requests:
@@ -200,7 +200,7 @@ spec:
                   fieldPath: spec.nodeName
       initContainers:
         - name: install-multus-binary
-          image: ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.3-thick
+          image: ghcr.io/cozystack/cozystack/multus-cni:latest@sha256:4b7d9081bdb9d6608ff9b941364fb3c71bf56a352ca3da1bbe14e6b64e6aa459
           command:
             - "/usr/src/multus-cni/bin/install_multus"
             - "-d"