feat: add Multus secondary CNI support

[fanyang89]

Summary

• add an EasyTier secondary CNI plugin with delegated IPv4 IPAM and ADD/DEL/CHECK lifecycle support
• port per-Pod instances to the portable-core architecture using resource-level network namespace socket contexts
• expose management RPC through a root-owned 0600 Unix socket after persisted instances are restored
• serialize attachment lifecycle operations and coordinate persisted TOML cleanup with IPAM release
• add Kubernetes DaemonSet/NAD manifests, release packaging, documentation, and reproducible netns/Kind integration tests

Scope

• CNI spec version 1.0.0
• Multus secondary attachment
• one IPv4 address per attachment
• Whereabouts used by the deployment example for cluster-wide IP allocation
• no default-route or DNS changes

Validation

• cargo clippy --all-targets --features full --all -- -D warnings
• cargo test --package easytier-cni
• cargo test --package easytier --lib runtime_unix_rpc
• cargo test --package easytier-core config::api --lib
• cargo check --package easytier --bin easytier-core
• shellcheck easytier-contrib/easytier-cni/test-netns.sh easytier-contrib/easytier-cni/test-kind.sh
• actionlint -shellcheck= .github/workflows/core.yml .github/workflows/test.yml
• root netns integration with two concurrent initial ADD calls, CHECK, DEL, idempotent DEL, and persisted-config cleanup
• clean three-node Kind v0.32.0 run with Kubernetes v1.36.1, Flannel v0.28.9, Multus v4.3.0, and Whereabouts v0.9.4
• cross-worker EasyTier ping/HTTP, primary-network Service/DNS preservation, MTU, DEL cleanup, and Whereabouts IP reuse

Final Kind result: 10.200.0.11 -> 10.200.0.10, 5/5 ping replies, 0% packet loss.

[Copilot]

Pull request overview

This PR adds Multus secondary CNI support by introducing a new easytier-cni delegate plugin that provisions a per-Pod EasyTier instance via a root-only Unix-socket RPC portal, along with netns plumbing and integration test scripts/manifests to validate Kubernetes/Kind operation.

Changes:

• Add Unix-socket RPC portal support to easytier-core and expose a netns field in the management API config.
• Introduce the easytier-cni binary implementing delegated IPv4 IPAM + ADD/DEL/CHECK lifecycle behavior.
• Add deployment manifests, documentation, CI packaging tweaks, and netns/Kind integration test scripts.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
easytier/src/rpc_service/api.rs	Adds ApiRpcServer::new_unix to serve RPC over Unix domain sockets.
easytier/src/proto/api_manage.proto	Extends NetworkConfig with an optional netns field for namespace targeting.
easytier/src/launcher.rs	Switches into configured netns before starting the instance runtime; adjusts runtime mode selection.
easytier/src/core.rs	Chooses between TCP vs Unix RPC servers based on --rpc-portal scheme prefix.
easytier/src/common/netns.rs	Adds netns path resolution (supporting absolute /proc/.../ns/net) and fallible NetNSGuard::try_new.
easytier-contrib/easytier-cni/src/main.rs	Implements the new CNI plugin: delegated IPAM, instance lifecycle via RPC, and interface verification.
easytier-contrib/easytier-cni/Cargo.toml	Adds a new workspace member crate for the CNI plugin and its dependencies.
easytier-contrib/easytier-cni/README.md	Documents installation, configuration, and lifecycle semantics for the CNI plugin.
easytier-contrib/easytier-cni/deploy/daemonset.yaml	Provides a privileged DaemonSet that installs the CNI binary and runs the Unix-socket daemon.
easytier-contrib/easytier-cni/deploy/network-attachment-definition.yaml	Adds a sample NAD for Multus with delegated Whereabouts IPAM.
easytier-contrib/easytier-cni/test-netns.sh	Adds a root netns-based integration test for ADD/CHECK/DEL behavior.
easytier-contrib/easytier-cni/test-kind.sh	Adds a reproducible Kind+Multus+Whereabouts multi-node integration test script.
Cargo.toml	Adds easytier-contrib/easytier-cni to the workspace members list.
Cargo.lock	Records dependency resolution for the new easytier-cni crate.
.github/workflows/core.yml	Updates CI path filters and packaging to include building/compressing easytier-cni for musl targets.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.