Available in editions:  Open/CE, BE, SE, SE+, Ultimate/EE, Core

The module lifecycle stage: General Availability

The module has 7 alerts.

The module is not enabled by default in any bundles.

How to explicitly enable the module...

You may explicitly enable or disable the module in one of the following ways:

  • Via Deckhouse web UI. In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the cni-flannel module and enable (or disable) the “Module enabled” toggle. Save changes.

    Example:

    Module enable/disable interface

  • Via Deckhouse CLI (d8).

    Use the d8 system module enable command for enabling, or d8 system module disable command for disabling the module (you need Deckhouse CLI (d8), configured to work with the cluster).

    Example of enabling the module:

    d8 system module enable cni-flannel

  • Using ModuleConfig cni-flannel.

    Set spec.enabled to true or false in ModuleConfig cni-flannel (create it if necessary);

    Example of a manifest to enable module cni-flannel:

    apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: cni-flannel
spec:
  enabled: true

How to configure the module...

You can configure the module in one of the following ways:

  • Via Deckhouse web UI.

    In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the cni-flannel module and enable the “Advanced Settings” switch. Fill in the required fields in the “Configuration” tab or specify the module settings in YAML format on the “YAML” tab, excluding the settings section. Save the changes.

    Example:

    Module Setup Interface

    You can also edit the ModuleConfig object cni-flannel on the “YAML” tab in the module settings window (“System” → “System Management” → “Deckhouse” → “Modules”, open the module cni-flannel) by specifying the schema version in the spec.version parameter and the necessary module parameters in the spec.settings section.

  • Via Deckhouse CLI (d8) (requires Deckhouse CLI (d8) configured to work with the cluster).

    Edit the existing ModuleConfig cni-flannel (for more details on configuring Deckhouse, see the documentation) by executing the following command:

    d8 k edit mc cni-flannel

    Make the necessary changes in the spec.settings section. If necessary, specify the schema version in the spec.version parameter. Save the changes.

    You can also create a file with manifest for ModuleConfig cni-flannel using the example below. Fill in the spec.settings section with the required module parameters. If necessary, specify the schema version in the spec.version parameter.

    Apply the manifest using the following command (indicate the manifest file name):

    d8 k apply -f <FILENAME>

    Example of a manifest for ModuleConfig cni-flannel:

    apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: cni-flannel
spec:
  version: 1
  enabled: true
  settings: # Module parameters from the "Parameters" section below.

Parameters

Schema version: 1

  • settings
    object
    • settings.ipv4OptionsGuard
      object

      Mitigation of CVE-2026-98432 (use-after-free in the Linux IPv4 TCP handshake triggered by a TCP SYN with IP options).

      A sidecar of the CNI agent installs a filter into the host network namespace and into every pod network namespace on the node, including pods started later. The filter matches IPv4 TCP SYN packets and IPv4 fragments carrying IP options.

      The filter follows the iptables mode (nft or legacy) that iptables-wrapper selects on the node, the same as the other Deckhouse components. In the nft mode, the filter uses native nftables expressions. In the legacy mode, it uses iptables with the u32 match. No kernel modules are loaded unless allowKernelModuleLoad is set. If the kernel modules of the selected mode are not loaded but those of the other mode are, the filter uses the other mode, and the node is reported by the D8IPv4OptionsGuardBackendMismatch alert. A node that cannot be protected is reported by the D8IPv4OptionsGuardNodeUnprotected alert.

      To exclude a node (for example, a node with CIPSO labeled networking), set the ipv4-options-guard.deckhouse.io/disabled: "true" label on it: the changes are reverted on that node.

      The mitigation does not fix the vulnerability: update the node kernel as soon as a fixed version is available.

      • settings.ipv4OptionsGuard.allowKernelModuleLoad
        boolean

        The filter needs the nf_tables kernel module in the nft mode and the ip_tables, iptable_raw, xt_tcpudp and xt_u32 kernel modules in the legacy mode.

        By default, kernel modules are not loaded: if a module of the mode selected by iptables-wrapper is not loaded, the filter uses the other mode when its modules are loaded, and the node is reported as unprotected otherwise. Set to true to load the modules of the selected mode.

        Default: false

      • settings.ipv4OptionsGuard.disableMPTCP
        boolean

        In the Enforce mode, set net.mptcp.enabled=0 in the host and in every pod network namespace. This removes the precondition of the published exploit.

        Listeners opened before the change stay MPTCP until the process is restarted. After a node reboot, MPTCP on the host is disabled again once the CNI agent starts.

        Default: true

      • settings.ipv4OptionsGuard.mode
        string

        Operating mode.

        If the mode is not set, it is Enforce in clusters installed with the mitigation and Audit in clusters that existed before it.

        • Audit — matching packets are only counted (the d8_ipv4_options_guard_matched_packets_total metric and the D8IPv4OptionsGuardMatchedTraffic alert). Use it to check that no workload relies on IP options. While any node is in this mode, the D8IPv4OptionsGuardAuditMode alert reminds that the cluster is not protected yet.
        • Enforce — matching packets are dropped, and MPTCP is disabled if disableMPTCP is set.
        • Disabled — the filter is removed from all network namespaces, including running pods, and net.mptcp.enabled is restored to the value it had before.

        The mode is applied without restarting the CNI agent pods.

        Allowed values: Audit, Enforce, Disabled

    • settings.podNetworkMode
      string

      Work mode.

      NOTE! All cluster nodes must be rebooted after switching work mode. You can change the parameter only in bare metal clusters.

      Default: HostGW

      Allowed values: HostGW, VXLAN