docs: add VPC ingress control-plane plan - #342
Open
privateip wants to merge 1 commit into
Open
Conversation
Add the implementation plan for NSO's slice of HTTP ingress for VPC networks, scoped against the accepted design in PR #851 rather than #856's original (rejected) VPCAttachment framing. Key changes: - Document what NSO owns: HTTPProxy backend API + translation, extension server VRF socket-bind mutation, sidecar wiring - Ground each step in existing code (httpproxy_controller.go, gateway_controller.go, extensionserver package) - Flag coordination points with #854/#855 (tenant-id label, VRF device naming) that still need byte-for-byte confirmation - Recommend same-namespace-only resolution and cutting TPP integration from this pass, both already applied to issue #856
8 tasks
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Issue #856 asked NSO to reconcile a
VPCAttachmentresource, but that design was rejected — the accepted design (datum-cloud/enhancements#851) keeps Envoy on the cluster overlay and disambiguates tenants via a per-tenant VRF on Envoy's own node instead. This plan documents NSO's actual slice of that design: referencing (not synthesizing) theEndpointSlicea VPC pod publishes, skipping Service synthesis for it downstream, and patching the resulting Envoy cluster with a socket-bind option naming the tenant's VRF device.Test plan
httpproxy_controller.go,gateway_controller.go,extensionserver) accurately enough to implement fromRelated to datum-cloud/enhancements#856