So it's the "compiler" for a CNI spec into a configuration for a linux network namespace?

Yeah I think that's a reasonable way to think of it. When a container (or Pod) gets created it needs a handful of network stuff setup, from creating the virtual network interfaces, setting up route tables. nftables/iptables rules, assigning an IP address, setting up NAT, configuring container-to-container networking, etc.

Thanks, that makes sense. I'd prefer it'd be called something else than a "network stack", but that's life.