fix: do not tag non-owned ERIs with creator=alibabacloud-erdma-controller

EnsureEriTags is called on ENIs that may not have been created by this
controller (ECS-console pre-bound ERDMA NICs, Primary ENIs converted to
RDMA, backfilled legacy nodes). Tagging them with creator=alibabacloud-
erdma-controller is misleading. Only the terway-excluded and instance-id
tags are now applied; the creator tag remains exclusively on ENIs this
controller actually creates via CreateNetworkInterface.

Author: BSWANG

README.md

@@ -86,23 +86,6 @@ kubectl get erdmadevices
 kubectl get node -o yaml | grep aliyun/erdma
 ```
 
-### Coexistence with terway CNI
-
-To prevent terway from allocating Pod IPs from ERDMA network interfaces, this
-controller tags every managed ERI with the following tags:
-
-| Tag Key | Tag Value |
-|---------|-----------|
-| `creator` | `alibabacloud-erdma-controller` |
-| `instance-id` | the ECS instance id |
-| `terway.alibabacloud.com/excluded` | `true` |
-
-The tags are applied both to ENIs created by this controller and to ENIs
-already attached to the node (e.g. ERDMA NICs bound through the ECS console
-before the node joined the cluster). Recent terway versions recognize these
-tags as a built-in block list and will skip the corresponding ENIs, so no
-manual `eni_tag_filter` configuration on the terway side is required.
-
 ### Using ERDMA Accelerated Network
 #### Pod Configurations to Enable ERDMA Accelerated Network
 * add `aliyun/erdma` resource in pod spec # config erdma devices for pod

internal/controller/eri.go

@@ -198,7 +198,11 @@ func (e *EriClient) ConvertPrimaryENI(primaryENI string, instanceID string, queu
 	return nil
 }
 
-// EnsureEriTags adds the creator/instance-id/terway-excluded tags to the given ENIs.
+// EnsureEriTags adds the terway-excluded and instance-id tags to the given ENIs.
+// It deliberately does NOT add the creator tag because this method is called on
+// ENIs that may not have been created by erdma-controller (e.g. ECS-console
+// pre-bound ERDMA NICs or Primary ENIs converted to RDMA). The creator tag is
+// only set at CreateNetworkInterface time for ENIs this controller actually creates.
 // TagResources is idempotent on the cloud side: re-applying the same (key,value)
 // pair is a no-op, so this is safe to call repeatedly. instanceID may be empty,
 // in which case the instance-id tag is skipped.
@@ -207,9 +211,6 @@ func (e *EriClient) EnsureEriTags(eniIDs []string, instanceID string) error {
 		return nil
 	}
 	tags := []*ecs.TagResourcesRequestTag{{
-		Key:   ptr.To(eriTagCreatorKey),
-		Value: ptr.To(eriTagCreatorValue),
-	}, {
 		Key:   ptr.To(eriTagExcludedKey),
 		Value: ptr.To(eriTagExcludedValue),
 	}}