// 创建vxcan pair: vxcan0_1 and vxcan00_1
ip link add vxcan0_1 type vxcan peer name vxcan00_1

// 将vxcan00_1移到pod1的netns内
ip link set vxcan00_1 netns <pod1ContainerPid>

// up vxcan0_1
ip link set vxcan0_1 up

// 将pod1内的vxcan00_1改名，改成can0
nsenter -t <pod1ContainerPid> -n ip link set vxcan00_1 name can0

// up can0 in pod1
nsenter -t <pod1ContainerPid> -n ip link set can0 up

// 将host的can0读出流量转发到vxcan0_1
cangw -A -s can0 -d vxcan0_1 -e

// 将vxcan0_1写入流量转发到can0
cangw -A -s vxcan0_1 -d can0 -e

// controller.go
var (
	targetPodLabel = map[string]string{"shankisme.com/net_device": "can"}
)

type PodController struct {
	client.Client
	scheme *runtime.Scheme
}

func initAndStartController(cfg *rest.Config, scheme *runtime.Scheme) {
	mgr, err := manager.New(cfg, manager.Options{
		Scheme: scheme,
	})
	if err != nil {
		klog.Fatalf("unable to set up manager, err: %v", err)
	}

	c, err := controller.New("pod-controller", mgr, controller.Options{
		Reconciler: &PodController{
			Client: mgr.GetClient(),
			scheme: mgr.GetScheme(),
		},
	})
	if err != nil {
		klog.Fatal(err)
	}

	predicateLabelSelector, err := predicate.LabelSelectorPredicate(metav1.LabelSelector{
		MatchLabels: targetPodLabel,
	})
	if err != nil {
		klog.Fataf("predicate err: ", err)
	}

	err = c.Watch(
		&source.Kind{Type: &corev1.Pod{}},
		&handler.EnqueueRequestForObject{},
		predicateLabelSelector,
		predicate.Funcs{
			CreateFunc: func(ce event.CreateEvent) bool {
				klog.Infof("pod[name=%s namespace=%s] created. enqueue.", ce.Object.GetName(), ce.Object.GetNamespace())
				return true
			},
			DeleteFunc: func(de event.DeleteEvent) bool {
				return false
			},
			UpdateFunc: func(ue event.UpdateEvent) bool {
				return false
			},
			GenericFunc: func(ge event.GenericEvent) bool {
				return false
			},
		},
	)
	if err != nil {
		klog.Fatalf("controller watch err: ", err)
	}

  klog.Info("start controller manager...")
  if err := mgr.Start(context.Background()); err != nil {
    klog.Fatalf("manager start err: %v", err)
  }
}

...
status:
  containerStatuses:
    - containerID: docker://a4a353497809c3802336f59f444cd1615ef65886460c6aed04f7b2669771796f
      image: <image>
      imageID: <imageID>
...

// controller.go
var (
  requeueInterval = 5 * time.Second
)

func (c *PodController) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) {
  instance := corev1.Pod{}
  c.Client.Get(context.Background(), types.NamespacedName{Name: req.Name, Namespace: req.Namespace}, &instance)

  containerRuntime, containerID, err := utils.ResolvePodFirstContainerID(instance)
  if err != nil {
    klog.Error(err, "requeue.")
    return reconcile.Result{RequeueAfter: requeueInterval}, err
  }
  containerPid, err := container_runtime.GetCilent(containerRuntime).GetPidFromContainerID(containerID)
  if err != nil {
    klog.Errorf("pod[name=%s] runtime:%s getPidFromContainerID err: %v requeue.", req.Name, containerRuntime, err)
    return reconcile.Result{RequeueAfter: requeueInterval}, err
  }

  if containerPid == 0 {
    klog.Errorf("container pid 0, pod[name=%s] requeue.", req.Name)
    return reconcile.Result{RequeueAfter: requeueInterval}, err
  }

  utils.CreateVxcanPairAndAddToCangwRule(containerPid, req.Name, req.Namespace)
  if !utils.ExpectedCansExistInContainer(containerPid) {
    err = fmt.Errorf("expected CAN not found in container requeue")
    klog.Error(err)
    return reconcile.Result{RequeueAfter: requeueInterval}, err
  }

  return reconcile.Result{}, nil
}

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: can-allocator
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: can-allocator
  template:
    metadata:
      labels:
        name: can-allocator
    spec:
      priorityClassName: system-node-critical
      hostNetwork: true
      hostPID: true
      nodeSelector:
        node-role.kubernetes.io/master: "true"
      containers:
      - name: can-allocator
        image: <image>
        securityContext:
          privileged: true
        volumeMounts:
          - name: docker-sock
            mountPath: /var/run/docker.sock
          - name: modules
            mountPath: /lib/modules
        imagePullPolicy: IfNotPresent
      serviceAccountName: can-allocator-sa
      volumes:
        - name: docker-sock
          hostPath:
            path: /var/run/docker.sock
        - name: modules
          hostPath:
            path: /lib/modules