feat: give every instance its own network interface

[scotwells]

An instance asks for a network interface the way a pod asks for storage. It says what it needs, and gets back the addresses required to bring one up.

What a consumer writes

A workload names a kind of address, and every replica gets one of its own:

networkInterfaces:
  - network:
      name: default
    ipFamilies:
      - IPv6
      - IPv4
    reclaimPolicy: Retain
    addresses:
      - class: public-unicast-ipv4

Nothing here names a subnet, a prefix length, a location, or an address. A consumer names a kind of address and the platform decides the rest.

What they get back

Today an instance prints an address column that is always blank. This fills it in, and with more than one address:

status:
  networkInterfaces:
    - name: eth0
      addresses:
        - family: IPv6
          address: 2001:db8:a001::/96
          primary: true
        - family: IPv4
          address: 10.128.0.2/32
      externalAddresses:
        - family: IPv4
          address: 198.51.100.11

An address a workload keeps

An address is claimed for a slot rather than for the instance filling it, so replacing, rescheduling, and redeploying keep the address. Surviving a scale-down takes Retain.

Event	Delete	Retain
Instance replaced or rescheduled	same addresses	same
Scale down then back up	new addresses	same addresses
Workload deleted then recreated	new addresses	same addresses

What stops being a problem

Every instance now gets its own addresses. Today one allocation is shared across a whole deployment, so instances cannot be told apart by address.

One instance waiting on an address no longer holds back its siblings — an exhausted pool stalls the instance that hit it, not the deployment.

And when an address cannot be had, the instance says why: an exhausted pool, a family the network does not carry, a project that cannot be resolved. An instance stuck behind an address it never got is a new way to be stuck, and it needs to be legible.

Not on yet

This ships behind the NetworkingIntegration feature gate, which stays off. Nothing changes for anyone until it is turned on.

Readiness waits on the address existing, not on the data plane carrying it — the part that reports traffic is a separate change, and waiting for it today would hold every instance forever.

Related

• Closes part of Integrate with network services operator for IP address assignment #112
• Depends on feat: give workloads an interface they can claim network-services-operator#360, which defines the interface being claimed. The dependency is pinned to that branch and needs re-pinning to a release before this merges.
• Addressing model proposed in docs: propose IP classes for workload address allocation #210