From 55aa4e3e109ae1e6ed5cb35bcc89a6eb0193304f Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Wed, 23 Sep 2026 10:57:29 +0800
Subject: [PATCH] fix(k8s): link the CNI dirs on the k3s agent nodes

cilium writes /etc/cni/net.d while istio-cni reads k3s's own dir, so on the new workers the chained plugin never found a network config. Add the symlinks the server module already has.
---
 lib/genK3sAgentModule.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/genK3sAgentModule.nix b/lib/genK3sAgentModule.nix
index e4f28095..a94b03da 100644
--- a/lib/genK3sAgentModule.nix
+++ b/lib/genK3sAgentModule.nix
@@ -42,4 +42,15 @@ in
       in
       pkgs.lib.concatStringsSep " " flagList;
   };
+
+  # Link k3s's CNI directories to the conventional locations, so CNI plugins
+  # that write to /etc/cni/net.d or /opt/cni/bin (cilium, istio-cni) share them
+  # with k3s. Without this, cilium writes /etc/cni/net.d while istio-cni reads
+  # k3s's own dir, and the chained plugin never finds a network config.
+  # Mirrors the server module.
+  systemd.tmpfiles.rules = [
+    "L+ /opt/cni/bin - - - - /var/lib/rancher/k3s/data/cni/"
+    "d /var/lib/rancher/k3s/agent/etc/cni/net.d 0751 root root - -"
+    "L+ /etc/cni/net.d - - - - /var/lib/rancher/k3s/agent/etc/cni/net.d"
+  ];
 }