docs: add VPC ingress control-plane plan - #342
Open
privateip wants to merge 2 commits into
Open
Conversation
8 tasks
8 tasks
Add the implementation plan for NSO's slice of HTTP ingress for VPC networks, scoped against the accepted design in PR #851 rather than #856's original (rejected) VPCAttachment framing. Key changes: - Document what NSO owns: HTTPProxy backend API + translation, extension server VRF socket-bind mutation, sidecar wiring - Ground each step in existing code (httpproxy_controller.go, gateway_controller.go, extensionserver package) - Flag coordination points with #854/#855 (tenant-id label, VRF device naming) that still need byte-for-byte confirmation - Recommend same-namespace-only resolution and cutting TPP integration from this pass, both already applied to issue #856
privateip
force-pushed
the
docs/vpc-ingress-control-plane-plan
branch
from
August 20, 2026 11:23
466481a to
161a6e6
Compare
An exhaustive review verified every code claim in the plan against current main and the VRF/socket-bind mechanism against kernel/Envoy behavior. Fold the findings back into the plan so implementation starts from corrected, grounded detail instead of the original draft. Key changes: - Grant CAP_NET_RAW to the Envoy container for its SO_BINDTODEVICE call; the sidecar's CAP_NET_ADMIN alone does not cover this - Bound the VRF device name to IFNAMSIZ - 1 (15 chars) instead of an unbounded vrf-<tenant-id> string - Call out the manual config/extension-server/rbac/role.yaml edit make manifests does not generate - Expand the HTTPProxy and Gateway controller steps to cover unconditional existing code (URL parsing, upstream Get + finalizer, BackendTLSPolicy synthesis) that must be bypassed, not just the synthesis lines originally cited - Flag the tenant-id label's trust boundary as an open blocker, since NSO's own manager already holds unrestricted downstream EndpointSlice RBAC - Correct the EG version-pin-comment target to Taskfile.test-infra.yml instead of go.mod - Note the downstream-native, no-upstream-owner watch has zero precedent in this repo and should be prototyped before the rest of the Gateway controller branch is built on it - Refresh drifted line numbers and the Coraza sidecar mechanism description (native EnvoyDeployment fields, not patch-gated)
privateip
enabled auto-merge
August 20, 2026 12:53
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Issue #856 asked NSO to reconcile a
VPCAttachmentresource, but that design was rejected — the accepted design (datum-cloud/enhancements#851) keeps Envoy on the cluster overlay and disambiguates tenants via a per-tenant VRF on Envoy's own node instead. This plan documents NSO's actual slice of that design: referencing (not synthesizing) theEndpointSlicea VPC pod publishes, skipping Service synthesis for it downstream, and patching the resulting Envoy cluster with a socket-bind option naming the tenant's VRF device.Revised after an exhaustive review that verified every code claim against current
mainand the VRF/socket-bind mechanism against actual kernel/Envoy behavior. That review surfaced several corrections now folded in:CAP_NET_RAWfor itsSO_BINDTODEVICEcall — the sidecar'sCAP_NET_ADMINalone doesn't cover this.IFNAMSIZ - 1(15 chars); the originalvrf-<tenant-id>scheme is unbounded.config/extension-server/rbac/role.yaml) is hand-maintained —make manifestswon't add theEndpointSlicegrant this plan needs.Get+ finalizer stamp,BackendTLSPolicysynthesis) that has to be bypassed, not just the synthesis lines originally cited.EndpointSliceobjects.Test plan
httpproxy_controller.go,gateway_controller.go,extensionserver) accurately enough to implement fromRelated to datum-cloud/enhancements#856