feat: Take the egress shard's identity from its EgressShard spec - #607
Merged
Merged
Conversation
galactic-nat took its shard SID, masquerade addresses, NAT64 prefix, and uplinks from env vars on its DaemonSet, so every shard node needed a hand-written per-node patch, and the EgressShard CRD only echoed back what the process was started with. The identity is a fabric-wide allocation decision, and the uplinks are the same ones the CNI's SRv6 datapath already derives from the node itself. Drive the datapath from the CRD instead. The process attaches its XDP program at startup with no identity, and EgressShardReconciler programs shard_config_table from the spec of the one EgressShard targeting its node. Status now reports what the datapath is actually programmed with, and the BGP advertisement is built from status, so the fabric only learns an identity the node translates with. Uplinks are auto-detected with the CNI's own derivation, so the shard and the CNI on a node converge on the same interfaces. XDP-specific bond handling resolves a bonding master to its slaves only. GALACTIC_NAT_UPLINK_INTERFACES remains as an override for nodes where detection is ambiguous. An unconfigured shard previously claimed traffic it should not. shard_config_table is an array map, so the dispatcher's NULL check never fired: an unconfigured shard read an all-zero row whose zero SID matched every destination with a zero top 64 bits. The dispatcher now treats a row serving no family as unconfigured. Key changes: - Remove GALACTIC_NAT_SHARD_SID, _SHARD_PUB_ADDR6, _SHARD_PUB_ADDR4, and _NAT64_PREFIX with their flags; the node name is the only required setting - Make GALACTIC_NAT_UPLINK_INTERFACES an optional override of auto-detection (natattach.ResolveUplinks over attach.DetectUplinks and ResolveTargets) - Add the Programmed condition: AddressesProgrammed, AddressUnassigned, ProgrammingFailed, or ShardConflict when more than one EgressShard targets a node - Clear the datapath and withdraw the advertisement when a node's shard is deleted or has no usable identity, including at startup for a shard deleted while the process was down - Report healthy once attached rather than once programmed, so a node awaiting an identity does not block the DaemonSet rollout - Enable IPv4 forwarding on the uplinks only once a shard is assigned an IPv4 address - Gate the XDP dispatcher on the config row serving a family, add natmap ShardConfigTable.Clear, and read a zero row as unconfigured - Move the containerlab shards' identity into each site's EgressShard spec and read the IPv4 address from status in the verify tasks - Update the NAT configuration reference, lab README, and manifest comments - Bump go.datum.net/network to main, which carries the spec fields (network#23, network#25), with no local replace - Build ResolveUplinks on the bond expansion ResolveTargets already does, rather than a second copy of it Resolves #581 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
scotwells
approved these changes
Sep 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Each egress shard's SID, masquerade addresses and NAT64 prefix were set by hand in a per-node patch, and the EgressShard object only echoed them back. They now come from the EgressShard's spec, uplinks are auto-detected the way the CNI detects its own, and the node name is the only required setting. This also fixes an unconfigured shard claiming traffic it had no identity for, because it read an empty config row as a match.
Breaking changes
The shard identity env vars and flags are gone; set the same values in each shard's EgressShard spec, which needs the network CRDs from datum-cloud/network#25 or later.
Test plan
Resolves #581
🤖 Generated with Claude Code