chore: Remove unused vmtap-cni plugin

AGENTS.md

@@ -11,7 +11,7 @@ other two where the boundary matters:
 
 | Document                                                                   | Covers                                                                                                                                            | Start here when you're touching...                                                                                                                                                                                                                                                   |
 | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| [docs/agents/ARCHITECTURE-CNI.md](docs/agents/ARCHITECTURE-CNI.md)         | The CNI attach chain: `galactic-cni` (installer), `galactic-veth`, `galactic-tap`, `galactic-ipam`, `galactic-bgp`, `galactic-route`, `vmtap-cni` | Pod/VM attach or detach behavior, CNI config fields/conflists, IPAM, the SRv6 uSID TC-BPF datapath's CNI-side registration, or anything under `cmd/galactic-{cni,veth,tap,ipam,bgp,route}`/`cmd/vmtap-cni`, `internal/cni*`, `internal/installer`, `internal/vmtap`                  |
+| [docs/agents/ARCHITECTURE-CNI.md](docs/agents/ARCHITECTURE-CNI.md)         | The CNI attach chain: `galactic-cni` (installer), `galactic-veth`, `galactic-tap`, `galactic-ipam`, `galactic-bgp`, `galactic-route` | Pod/VM attach or detach behavior, CNI config fields/conflists, IPAM, the SRv6 uSID TC-BPF datapath's CNI-side registration, or anything under `cmd/galactic-{cni,veth,tap,ipam,bgp,route}`, `internal/cni*`, `internal/installer`                  |
 | [docs/agents/ARCHITECTURE-ROUTER.md](docs/agents/ARCHITECTURE-ROUTER.md)   | The BGP/EVPN control plane: `galactic-router` (BGPRouter/BGPPeer/BGPAdvertisement/BGPPolicy/BGPVRFInstance reconcilers, embedded GoBGP, GC)       | BGP CRD reconciliation, GoBGP runtime behavior, EVPN path construction, orphaned-CRD/VRF garbage collection, or anything under `cmd/galactic-router`, `internal/reconcile`, `internal/runtime`, `internal/gc`, `internal/model`, `internal/hash`                                     |
 | [docs/agents/ARCHITECTURE-GATEWAY.md](docs/agents/ARCHITECTURE-GATEWAY.md) | The edge XDP NAT+LB gateway: `galactic-gateway`, `NetworkGateway`/`NetworkRule` reconcilers, the edge XDP datapath                                | Ingress load-balancing/NAT, `NetworkGateway`/`NetworkRule` CRDs, Active-Active BGP placement, or anything under `cmd/galactic-gateway`, `internal/gateway`, `internal/plumbing/ebpf/edge{prog,map,attach}`, the `NetworkGateway`/`NetworkRule`-related code in `internal/controller` |
 

README.md

@@ -32,7 +32,7 @@ See the [galactic DevContainer](./.devcontainer/galactic/) for development envir
 
 ### Production Deployment
 
-Manifests for a real cluster live under [`config/`](./config/), composed with [Kustomize](https://kustomize.io). One command deploys the `galactic-system` namespace (labeled `pod-security.kubernetes.io/enforce: privileged` — every DaemonSet here needs it, for hostPath volumes, hostNetwork, and elevated capabilities), the `galactic-cni` DaemonSet, both `galactic-router` roles — `tenant` (per-node, runs everywhere except control-plane nodes) and `tenant-control` (BGP route reflector, opt-in — stays at zero replicas until nodes are labeled `galactic.datumapis.com/node: control`) — and the `vmtap-cni` DaemonSet (a second, standalone CNI plugin that gives Unikraft microVMs managed by `kraftlet` access to the pod's Cilium-assigned identity; see [`docs/vmtap-cni/configuration.md`](./docs/vmtap-cni/configuration.md)):
+Manifests for a real cluster live under [`config/`](./config/), composed with [Kustomize](https://kustomize.io). One command deploys the `galactic-system` namespace (labeled `pod-security.kubernetes.io/enforce: privileged` — every DaemonSet here needs it, for hostPath volumes, hostNetwork, and elevated capabilities), the `galactic-cni` DaemonSet, and both `galactic-router` roles — `tenant` (per-node, runs everywhere except control-plane nodes) and `tenant-control` (BGP route reflector, opt-in — stays at zero replicas until nodes are labeled `galactic.datumapis.com/node: control`):
 
 ```bash
 kubectl apply -k config/
@@ -122,7 +122,7 @@ task          # list available tasks
 
 ```bash
 task build           # produces bin/{galactic-cni,galactic-veth,galactic-tap,galactic-ipam,
-                     # galactic-bgp,galactic-route,galactic-router,galactic-gateway,vmtap-cni}
+                     # galactic-bgp,galactic-route,galactic-router,galactic-gateway}
 task lint            # golangci-lint + yamlfmt; lint-fix applies safe auto-fixes
 task ci              # full pipeline: lint → build → test:unit → test:e2e
 ```

Taskfile.yaml

@@ -143,7 +143,6 @@ tasks:
       - go build -ldflags "{{.LDFLAGS}}" -o bin/galactic-router ./cmd/galactic-router
       - go build -ldflags "{{.LDFLAGS}}" -o bin/galactic-gateway ./cmd/galactic-gateway
       - go build -ldflags "{{.LDFLAGS}}" -o bin/galactic-nat66 ./cmd/galactic-nat66
-      - go build -ldflags "{{.LDFLAGS}}" -o bin/vmtap-cni ./cmd/vmtap-cni
       - GOBIN={{.LOCALBIN}} go install github.com/containernetworking/plugins/plugins/main/host-device@v1.9.1
 
   ##

cmd/galactic-tap/main.go

@@ -25,8 +25,7 @@ const (
 
  The tap master plugin in the galactic CNI chain, for VM-based workloads
  (Kata, Firecracker, kraftlet/Unikraft) attaching directly to a galactic VPC
- network. Unrelated to vmtap-cni, which is chained after Cilium's own CNI
- plugin for a different purpose entirely (see its own doc comment).
+ network.
 
  Find more information at: https://www.datum.net/docs`
 )

config/fabric-router/daemonset.yaml

@@ -10,7 +10,7 @@ spec:
     matchLabels:
       app.kubernetes.io/name: fabric-router
   # Unlike every other DaemonSet in config/ (galactic-cni, galactic-router,
-  # galactic-gateway, vmtap-cni), this one owns the eBGP session to the
+  # galactic-gateway), this one owns the eBGP session to the
   # physical fabric switch, not an in-cluster control-plane relationship.
   # Bouncing FRR here drops the node's only underlay path, so every overlay
   # SRv6/EVPN path riding on it blackholes until the eBGP session
@@ -46,8 +46,8 @@ spec:
       # depends on before it can start — so this must tolerate NotReady the
       # same way a CNI plugin does, or it never gets scheduled early enough.
       # Blanket-tolerate all taints, same as every other DaemonSet in
-      # config/ (galactic-cni, galactic-router, galactic-gateway,
-      # vmtap-cni). Placement is controlled entirely by the node affinity
+      # config/ (galactic-cni, galactic-router, galactic-gateway).
+      # Placement is controlled entirely by the node affinity
       # below (edge/control/gateway roles) — tolerations don't need to be
       # scoped, and scoping them risks silently blocking fabric-router if
       # an unenumerated taint (a new role taint, a maintenance taint, etc.)

config/kustomization.yaml

@@ -2,4 +2,3 @@ resources:
   - galactic-system
   - galactic-cni
   - galactic-router
-  - vmtap-cni

containers/galactic-cni/Dockerfile

@@ -133,20 +133,6 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build \
       -X go.datum.net/galactic/internal/metadata.GitURL=${GIT_URL}" \
     -o galactic-route cmd/galactic-route/main.go
 
-# Build vmtap-cni. It ships in this image rather than one of its own so the
-# vmtap DaemonSet (config/vmtap-cni/) can reference the same published
-# ghcr.io/datum-cloud/galactic-cni image instead of a second, separately
-# published image.
-RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build \
-    -ldflags "-s -w \
-      -X go.datum.net/galactic/internal/metadata.Version=${VERSION} \
-      -X go.datum.net/galactic/internal/metadata.GitCommit=${GIT_COMMIT} \
-      -X go.datum.net/galactic/internal/metadata.GitTreeState=${GIT_TREE_STATE} \
-      -X go.datum.net/galactic/internal/metadata.BuildDate=${BUILD_DATE} \
-      -X go.datum.net/galactic/internal/metadata.SPDXLicense=${SPDX_LICENSE} \
-      -X go.datum.net/galactic/internal/metadata.GitURL=${GIT_URL}" \
-    -o vmtap-cni cmd/vmtap-cni/main.go
-
 # Build the host-device CNI plugin binary, used by galactic-veth to move
 # the veth endpoint into the container network namespace. GOBIN can't be set
 # for a cross-compiled `go install` (the toolchain rejects it outright when
@@ -172,7 +158,6 @@ COPY --from=builder /workspace/galactic-tap /galactic-tap
 COPY --from=builder /workspace/galactic-ipam /galactic-ipam
 COPY --from=builder /workspace/galactic-bgp /galactic-bgp
 COPY --from=builder /workspace/galactic-route /galactic-route
-COPY --from=builder /workspace/vmtap-cni /vmtap-cni
 COPY --from=builder /workspace/host-device /host-device
 COPY --from=builder /var/run/galactic-cni /var/run/galactic-cni
 
@@ -189,7 +174,6 @@ COPY --from=production /galactic-tap /galactic-tap
 COPY --from=production /galactic-ipam /galactic-ipam
 COPY --from=production /galactic-bgp /galactic-bgp
 COPY --from=production /galactic-route /galactic-route
-COPY --from=production /vmtap-cni /vmtap-cni
 COPY --from=production /host-device /host-device
 COPY --from=production /var/run/galactic-cni /var/run/galactic-cni