feat(api): make VPCAttachment usable as the interface-to-data-plane bridge

[scotwells]

VPCAttachment is the object that connects an NSO NetworkInterface, which knows the addresses, to the galactic data plane, which programs them. Today the type cannot serve that role.

Status could not be written partially. Eight fields were required, so none could be set without all of them: an identifier could not be recorded before a pod attached, a pending or failed attachment could not be reported through conditions alone, and a guest managing its own addressing could never report at all, since podSubnet was required and had to be a CIDR. Only conditions is required now.

Spec gains two fields. interfaceRef names the NetworkInterface this attachment realizes. interface.mode is Netns or Hypervisor — how the guest consumes the NIC, which is the difference between a container and a microVM. It deliberately names no CNI and no Linux device type, so the controller maps it to a plugin and the API does not move when galactic's plugins do. interface.addresses may now be empty.

apiVersion: cloud.datumapis.com/v1alpha1
kind: VPCAttachment
metadata: {name: web-0-eth0, namespace: my-project}
spec:
  vpc: {name: default-us-central-1}
  interfaceRef: {name: web-0-eth0}
  interface:
    name: eth0
    mode: Hypervisor
    addresses: ["fd00:10:ff01:0:1::1/96", "172.20.1.7/32"]

Two corrections

The XValidation rule on the spec did not compile — the source contains a U+201D smart quote, and controller-gen emits it verbatim, so the CRD is rejected on install. The committed CRD had drifted and still showed the old form, which is why it went unnoticed. Removed rather than repaired: vpc is required and VPCRef.Name already has MinLength=1.

status.vrfInterface's example described the legacy per-attachment VRF name. Galactic made the VRF per-VPC, so the current form is G000000010V.

Related

Completes the provider-facing half of datum-cloud/network-services-operator#164 — NetworkInterface.status.attachmentRef is declared there so "infra providers watch only NetworkInterface", and VPCAttachment is the object it points at. Consumed by datum-cloud/compute#112. Network services integration under datum-cloud/galactic#17.

Stacked with #6, which needs these fields.

🤖 Generated with Claude Code