chore: split gateway docs into separate file and update tooling - #14
Merged
Conversation
Adds the CRD types for the edge NAT+LB gateway engine's control plane: NetworkGateway (one per dedicated gateway-role node, spec.targetRef names the node) and NetworkRule (namespaced, tenant-writable, carries an ingress VIP/protocol/port and backend targets for a vpc/vpcAttachment). NetworkGatewayStatus carries sRv6Address rather than a tunnel endpoint address: the consuming galactic-router design pivoted away from an earlier Geneve-overlay approach to pushing SRv6 uSID headers directly from an XDP program, so there is no tunnel endpoint to publish. This address is the gateway node's own SRv6-reachable address, used as the Full-NAT SNAT source for every ingress flow the node translates, and advertised into BGP the same way any workload prefix is (a BGPAdvertisement naming it at the reserved Argument 0, which PR #740 forbids ever registering into a tenant VRF, so it can never collide with real tenant state). NetworkRuleStatus.primaryNode implements the active-active BGP model: assigned once at creation (hash(vpcRef) % gateway node count) and never recomputed, so a later reconcile can't silently flip which node is preferred for a live VIP. Regenerated deepcopy methods and CRD manifests via controller-gen.
NetworkGateway and NetworkRule docs are now generated to docs/api/gateway.md via a dedicated .crd-ref-docs-gateway.yaml config, keeping bgp.md focused on the BGP API group. Added docs/api/index.md as a landing page linking both references. Updated Taskfile generate:docs target, AGENTS.md conventions, and the BGP crd-ref-docs config to ignore the gateway types. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
privateip
requested review from
0xmc,
ecv,
scotwells,
slindseysr and
yahyafakhroji
August 12, 2026 18:29
privateip
added a commit
to datum-cloud/galactic
that referenced
this pull request
Aug 12, 2026
…on webhook Adds the CRD-driven layer that feeds the gateway engine from the previous branch, and the NetworkRule admission webhook: - internal/controller/networkgateway_controller.go: NetworkGateway reconciler; watches NetworkGateway/NetworkRule, resolves backend SRv6 uSIDs (usidresolver.go), builds DesiredRule/DesiredBackend, and drives internal/gateway's Engine. - internal/controller/networkrule_controller.go: NetworkRule reconciler; finalizer, Status.PrimaryNode assignment, BGP-withdrawal- before-NAT-teardown delete ordering. - internal/controller/status.go: setGatewayCondition/setRuleCondition helpers. - internal/webhook: NetworkRuleValidator admission webhook (vpcRef/vpcAttachmentRef authorization) and a pluggable Authorizer interface (AllowAllAuthorizer placeholder pending the companion operator integration). - cmd/galactic-router/root.go: wires the webhook server into the manager, opt-in behind --webhook-enabled (internal/config/router.go). - go.mod: bump go.datum.net/network to the commit that adds the NetworkGateway/NetworkRule types (datum-cloud/network#14), now that they've landed upstream. This replaces an earlier, since-abandoned 'replace go.datum.net/network => ../network' stopgap that pointed at a sibling checkout while those types were still only local. - scripts/ci.sh: NETWORK_SHA extraction matches the require line's module path exactly, not just a substring. Known gap, not addressed by this branch: config/webhook/ (the ValidatingWebhookConfiguration + Service + cert-manager Certificate this webhook needs to actually run) doesn't exist yet. The webhook defaults to disabled (WebhookEnabled=false), so this doesn't affect any existing deployment, but the feature is incomplete without those manifests -- follow-up work, not in scope here. Third branch in the edge-gateway stack; builds on feat/edge-gateway-02-engine. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
privateip
added a commit
to datum-cloud/galactic
that referenced
this pull request
Aug 12, 2026
…on webhook Adds the CRD-driven layer that feeds the gateway engine from the previous branch, and the NetworkRule admission webhook: - internal/controller/networkgateway_controller.go: NetworkGateway reconciler; watches NetworkGateway/NetworkRule, resolves backend SRv6 uSIDs (usidresolver.go), builds DesiredRule/DesiredBackend, and drives internal/gateway's Engine. - internal/controller/networkrule_controller.go: NetworkRule reconciler; finalizer, Status.PrimaryNode assignment, BGP-withdrawal- before-NAT-teardown delete ordering. - internal/controller/status.go: setGatewayCondition/setRuleCondition helpers. - internal/webhook: NetworkRuleValidator admission webhook (vpcRef/vpcAttachmentRef authorization) and a pluggable Authorizer interface (AllowAllAuthorizer placeholder pending the companion operator integration). - cmd/galactic-router/root.go: wires the webhook server into the manager, opt-in behind --webhook-enabled (internal/config/router.go). - go.mod: bump go.datum.net/network to the commit that adds the NetworkGateway/NetworkRule types (datum-cloud/network#14), now that they've landed upstream. This replaces an earlier, since-abandoned 'replace go.datum.net/network => ../network' stopgap that pointed at a sibling checkout while those types were still only local. - scripts/ci.sh: NETWORK_SHA extraction matches the require line's module path exactly, not just a substring. - containers/galactic-router/Dockerfile: also regenerates internal/plumbing/ebpf/edgeprog's bpf2go output now, alongside internal/plumbing/ebpf/prog's -- the reconcilers added here wire internal/gateway.Engine into cmd/galactic-router for the first time, which transitively needs edgeprog's generated types. Known gap, not addressed by this branch: config/webhook/ (the ValidatingWebhookConfiguration + Service + cert-manager Certificate this webhook needs to actually run) doesn't exist yet. The webhook defaults to disabled (WebhookEnabled=false), so this doesn't affect any existing deployment, but the feature is incomplete without those manifests -- follow-up work, not in scope here. Third branch in the edge-gateway stack; builds on feat/edge-gateway-02-engine. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Split NetworkGateway and NetworkRule documentation out of
docs/api/bgp.mdinto a dedicateddocs/api/gateway.md, generated via a new.crd-ref-docs-gateway.yamlconfig.Changes
.crd-ref-docs-gateway.yaml— crd-ref-docs config targeting NetworkGateway/NetworkRule typesdocs/api/gateway.md— Generated gateway CRD field referencedocs/api/index.md— API docs index linking to both bgp.md and gateway.md (sourced fromtemplates/api-index.md).crd-ref-docs.yaml— Ignores gateway types so bgp.md stays BGP-onlyTaskfile.yaml—generate:docsnow runs both crd-ref-docs configs and copies the index templateAGENTS.md— Reflects the dual-doc structure and tooling in conventionsGenerated with Qwen Code