Services

Kubernetes CRDs for virtual networking, and the controller that reconciles them in a POP cell.

API group: cloud.datumapis.com/v1alpha1 Stability: Alpha Requires: Kubernetes 1.28+

---

What it is

Services defines Kubernetes Custom Resource Definitions for virtual tenant networking, plus vpc-controller, which realizes them against the galactic data plane.

The controller runs in a POP cell beside network-services-operator, compute and the workload providers. It turns a NetworkContext into a VPC identity; when a NetworkInterface claim is fulfilled it creates the VPCAttachment and the NetworkAttachmentDefinition, allocates the attachment identifier, and publishes the annotations a workload must carry; and it projects what the data plane reported back onto VPCAttachment and NetworkInterface status.

It also serves a mutating admission webhook that injects the Multus annotation into Pods labelled networking.datumapis.com/inject-interfaces: "true", so Multus knowledge stays inside the one component that writes NetworkAttachmentDefinitions.

It requires --attachment-mode (Netns or Hypervisor) — how guests in the cell consume an interface. There is no default, because defaulting would hand a microVM an interface it cannot use.

Resources

Resource	Kind	Description
VPC	vpcs	Virtual network with one or more IPv4/IPv6 CIDR blocks
VPCAttachment	vpcattachments	Binds a network interface to a VPC with addresses

A VPC defines a set of CIDR prefixes. A VPCAttachment connects a workload interface to that VPC:

apiVersion: cloud.datumapis.com/v1alpha1
kind: VPC
metadata:
  name: tenant-a
  namespace: default
spec:
  networks:
    - "10.100.0.0/24"
    - "fd00:a::/48"
---
apiVersion: cloud.datumapis.com/v1alpha1
kind: VPCAttachment
metadata:
  name: tenant-a-node-1
  namespace: default
spec:
  vpc:
    name: tenant-a
  interface:
    name: eth0
    addresses:
      - "10.100.0.5"
      - "fd00:a::5"

Quick start

kubectl apply -k config/crd      # types only
kubectl apply -k config/default  # types, RBAC and the controller

config/default requires cert-manager: it issues the webhook serving certificate and injects the CA into the MutatingWebhookConfiguration. The attachment mode is carried as the ATTACHMENT_MODE environment variable on the manager container (default Hypervisor), so a cell selects its mode with a small overlay patch rather than rewriting the args list.

CI publishes on every push and release:

• image: ghcr.io/datum-cloud/vpc-controller
• kustomize bundle (OCI, for Flux OCIRepository): ghcr.io/datum-cloud/vpc-controller-kustomize, with the image pinned to the matching tag

Development

task install      # Install all dev tools into ./bin/
task build        # go fmt + go vet + go build ./...
task test         # Run unit tests then e2e tests
task test:unit    # Run unit tests only
task lint         # golangci-lint + yamlfmt + .yml extension check
task lint-fix     # Auto-fix lint issues
task generate     # Regenerate deepcopy methods, CRD manifests, and API docs
task ci           # Full pipeline: build + lint + unit + e2e
task clean        # Remove ./bin/ and cover.out

Documentation

• VPC API reference — field definitions, validation rules
• Architecture — module layout, data flow
• Conventions — naming, markers, code style

License

AGPL-3.0