feat: Assign an egress shard's SID in spec - #25
Merged
Merged
Conversation
scotwells
previously approved these changes
Sep 23, 2026
A shard's SID still arrives as process configuration, so every shard node needs a hand-written patch on the galactic-nat DaemonSet even after its addresses moved into spec. That patch is the per-node configuration datum-cloud/galactic#581 removes: the shard's process should program its whole identity from its own EgressShard, and it cannot while the SID has nowhere in spec to live. Add spec.shardSID on the same terms as the addresses. It is write-once for the same reason they are: every established flow's reply is re-encapsulated from this SID, so changing it strands them. It stays operator-chosen until the addressing service hands out identifiers of this kind, which is what the status-only position was waiting for; moving it now changes who writes it, not who chooses it. status.shardSID keeps its key and becomes what the datapath is programmed with, matching the address fields. Key changes: - Add spec.shardSID, optional, IPv6-only, write-once, and unable to be unassigned once assigned - Re-specify status.shardSID as the SID the datapath is programmed with - Cover the new key in the JSON and omitempty unit tests - Extend the chainsaw scenario with a changed SID, an unassigned SID, and an IPv4 SID, each rejected Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
privateip
force-pushed
the
feat/egress-shard-sid-spec
branch
from
September 23, 2026 21:22
335a64e to
4bc9f18
Compare
scotwells
approved these changes
Sep 23, 2026
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#23 moves an egress shard's addresses into spec but leaves the SID in status, so each shard node still needs a hand-written DaemonSet patch to set it. datum-cloud/galactic#581 makes
galactic-natprogram its whole identity from its ownEgressShard, and it needs the SID in spec to do that.The SID is still chosen by an operator. This changes where that choice is written, not who makes it. It is write-once like the addresses, because every established flow's reply is re-encapsulated from it.
API
Test plan
go test ./api/...task lintegress-shard-address-immutabilityon a kind cluster: a changed SID, an unassigned SID, and an IPv4 SID are each rejected, and the first assignment is acceptedRelated to datum-cloud/galactic#581
🤖 Generated with Claude Code