feat(vpc): add the VPC controller that realizes attachments on the data plane

[scotwells]

Nothing in the org reconciles VPC or VPCAttachment. Galactic's CNI requires the NAD to have been "created by the external VPC operator before the CNI is invoked" — this is that operator, and this repo's first binary.

With it running in a POP cell, a compute Instance lands on a tenant VPC: NSO allocates the addresses, this controller turns them into galactic identifiers and a NetworkAttachmentDefinition, and the data plane's own report comes back as Programmed.

Contains #5's API changes, and targets main rather than that branch so CI runs at all.

Three reconcilers

Watches	Produces
NetworkContext	VPC, with a random 48-bit identifier
NetworkInterface	VPCAttachment + NAD + attachment identifier, status.vpc, attachmentRef, Prepared
BGPAdvertisement	Programmed, and the node-scoped facts

A fulfilled claim is the trigger, so no infrastructure provider creates an attachment or waits on one. Both objects are per-interface, so the identifier and the tap device name stay stable across instance replacement.

Decisions worth a reviewer's attention

A mutating Pod webhook injects k8s.v1.cni.cncf.io/networks. Whoever writes a NAD should be the only thing that knows NADs exist, so a provider stamps one opt-in label and nothing else. failurePolicy: Fail with an objectSelector narrowed to that label: an outage blocks exactly the Pods that need an interface, loudly, rather than blocking the cell or letting one boot unattached. The injection is recorded on the Pod.

--attachment-mode is required, with no default. Defaulting to Netns would hand a Unikraft microVM a veth it cannot use. It stands in for a capability class that does not exist yet; there is no AttachmentClass because a cell hosts one implementation today.

Prepared is the condition compute gates on. Programmed only becomes true at CNI ADD, after sandbox creation, so gating Pod creation on it deadlocks.

Identifiers are allocated by the leader, at random, so a freed one is not reissued while its BGPAdvertisement is still being collected. Object names never contain base62, which is not a valid lowercase RFC 1123 name.

Dependencies

go.datum.net/compute points at a merged commit on main; no branch pins remain.

Not covered

No envtest exercises a real admission request — the webhook's failure mode is a Pod coming up unattached, so that is the gap worth closing before this leaves draft. E2E not run.

Related

This is the "separate operator project" galactic handed VPC and VPCAttachment to when it removed them (its architecture doc names go.datum.net/cloud, and nadpatch.AnnotateNAD requires the NAD to have been "created by the external VPC operator before the CNI is invoked"). Network services integration under datum-cloud/galactic#17.

Realizes the data-plane end of datum-cloud/network-services-operator#164 and datum-cloud/compute#112: it writes the vpc, attachmentRef and Programmed fields those two leave for whoever programs the interface.

Allocating VPC identity here is a step toward datum-cloud/galactic#197 — one authority for a VPC's identity and address space rather than the CNI deciding locally.

Built on #5, and targets main rather than that branch so CI runs at all.

Deliberately out of scope: datum-cloud/galactic#332, #329 and #328 are data-plane concerns this controller does not touch. Note that the NAD is created per NetworkInterface rather than per VPC partly because two live workloads cannot currently share one attachment — the host interface name is derived from (vpc, vpcattachment) alone, so veth.Add deletes and recreates an existing one while tap.Add adopts it.

🤖 Generated with Claude Code

The merge-base changed after approval.

The merge-base changed after approval.