docs: Correct VRF/route granularity in ingress sidecar plan - #377
Open
privateip wants to merge 2 commits into
Open
docs: Correct VRF/route granularity in ingress sidecar plan#377privateip wants to merge 2 commits into
privateip wants to merge 2 commits into
Conversation
The #855 plan modeled the sidecar's VRF and SRv6 route as keyed by the (vpc, vpcAttachment) tenant label, but that contradicts the primitives it's built on: internal/crdnames.BGPVRFInstanceName documents the kernel VRF as keyed by (vpc, node), shared across every attachment of a VPC on a node, and internal/plumbing/vrf's Add/Delete/TableID and intf.GenerateInterfaceNameVRF all take vpc alone — there's no attachment-scoped variant. Each pod's SID also varies by its own hosting node (ComputeSID's nodeID parameter), so pods of the same tenant on different nodes carry different SIDs, meaning "one route per tenant" doesn't hold either. This revises the plan to a two-tier reconcile model: VRF lifecycle keyed by VPC alone, route lifecycle keyed by individual EndpointSlice (pod), with the tenant label used only for slice discovery/grouping, never as the kernel-side key. Also fixes the primitive function signatures in section 2 to match reality, corrects a reference that pointed at bgpvrfinstance_controller.go (an empty passthrough reconciler) instead of internal/reconcile/reconcile.go for the actual desired-state diffing pattern, adds the sidecar's flock-path reuse (/var/lib/cni/galactic-vrf) as a third pre-merge verification item alongside the two already flagged, and adds two new open decisions: RBAC blast radius of the cluster-wide EndpointSlice watch, and the platform-wide kernel state every gateway replica ends up carrying under the corrected #796 scope. No code changes — this is a planning document only, ahead of implementation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
kevwilliams
previously approved these changes
Aug 13, 2026
8 tasks
Settles §9's four still-open items from the prior revision pass: - RBAC blast radius (item 8): accept the recommended read-only ClusterRole as final, flag for #856's manifest reviewer - Per-replica platform-wide state (item 9): accept as-is for v1, lean on §6's VRF/route-count metrics and revisit at scale - Teardown grace-period interval (item 1): settle as a configurable knob with a 30s placeholder default, pending real #857 latency data - #856 deployment contract (item 3): confirm it stays a flagged dependency rather than writing it out further No scope or design changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The #855 implementation plan keyed the sidecar's VRF and SRv6 route by the
(vpc, vpcAttachment)tenant label, but the primitives it reuses key the kernel VRF by(vpc, node)only, and per-pod SIDs vary by hosting node even within one tenant. This revises the plan to a two-tier model — VRF lifecycle per VPC, route lifecycle per pod — fixes the primitive signatures and a misleading reconciler-file reference, and adds two previously-undiscussed risks (RBAC blast radius, per-replica platform-wide state) to the open decisions list.Test plan
Related to datum-cloud/enhancements#855