[privateip]

Summary

The MASQUE milestone needs proof that a CONNECT-IP server can run as an unprivileged Galactic Edge provider and keep tenants with identical addresses apart.

This adds a test-only fixture provider and a lab suite that checks isolation in both directions, NAT egress, a half-set-up instance killed without shutdown, pod recreation and asserted cleanup.

The proof covers the containerlab lab only. The target-platform run the issue also requires has no harness yet, so the issue stays open.

Compatibility and rollback

Test code, one lab image and one doc paragraph. Core behavior does not change. Revert the PR's commits to roll back.

Test plan

• Lint, build, unit and end-to-end tests pass locally
• Every lab row passes on this branch: each tenant's own workloads answer 250 of 250 probes, no probe crosses tenants, and cleanup is asserted
• CI passes
• Not run: the target-platform rows, which have no harness

Related to #974

[privateip]

Validation run locally. The lab run is from a clean checkout of 98f59d6, with the fixture image rebuilt from it. The repository checks ran at 8e84b06, and 98f59d6 only adds the teardown's removal of the fixture CA from the nodes.

Lab run, task verify:masque-conformance against the containerlab lab's dfw cluster. Core images were built from this branch's base (509c9c9) and loaded on dfw. Every subtest and the teardown passed, and the CA was gone from the nodes afterwards.

Row	Result
M16	The fixture process holds no capabilities and runs as 65532. galactic-edge created both TUN devices, owned by 65532. Unknown credential 401, credential for the other VPC 403, connector whose route core refused (PrefixNotGranted) 503
M07	Each tenant reached its own workloads on the compute node and on the fixture's node 250 of 250 times. It reached the other tenant's 0 times. Captures on all four workload links saw 250 of their own tenant's requests and 0 of the other's. The same holds after recreation
NAT egress	250 of 250 replies per tenant from the off-fabric host
Partial setup	The first instance answered 1000 of 1000 across the kill, with a 21 ms largest gap. Core reaped the killed instance's attachment after 17 s, its instance and lease after 31 s, and its refused route. The host link was gone at the next check
Recreation	The replacement served after 23 s. Core reaped the old attachments after 23 s and the old instance and lease after 24 s. The replacement's routes stayed accepted for 20 s
Teardown	The provider and core removed every attachment, instance, lease and route before the namespace was deleted. No fixture advertisement or host link remained. The tenants' edge-client pods kept their UIDs and still reached each other

Repository checks:

• task lint: golangci-lint reports 0 issues. yamlfmt passes with the repository config minus its .git/** exclude, because .git is a file in a worktree checkout.
• task build and task test:unit pass.
• task test:e2e passed on a second attempt. The first failed before any test ran: the image build timed out reaching the Go checksum database.
• The fixture's own unit tests pass under go test -race. They live outside the packages task test:unit runs.

Not run: the target-platform rows. No harness exists for a cluster of real nodes, so #974 stays open.

The lab's pod network does not carry UDP from a node to a pod on another node, so the CONNECT-IP client runs on the fixture's node. That changes only the client-to-fixture leg, not the gVPC path behind the fixture.

Settled here from the #989 findings in the acceptance matrix:

• A05: each direction has its own negative, with a positive control.
• A08: every capture must first see its own tenant's traffic.

Still open, and outside this change:

• A06: the registration type of the TUN device.
• A14: a namespace-only impostor case.
• A16: injected route drift.
• M16's forged-pod, version and token-extra cases, which the reference-provider conformance rows cover for the foundation.

[privateip]

Review record for this PR, covering two passes, with the ready phase run at the requester's direction after a split second pass.

First pass at 8e84b06: the adversarial review held, because the archived lab run was made from an uncommitted tree, and it raised a nit that teardown left the fixture CA on the lab nodes. The conventions review returned merge with nits (title length, commit subject length).

Fixes: a clean rerun from 98f59d6 passed every lab row, 98f59d6 removes the CA at teardown, and the title was shortened. Not applied: two commit subjects over 50 characters, because shortening them needs a force-push of published commits.

Second pass at 98f59d6: the re-review returned merge, confirming all three fixes against the clean run's recorded commit and dirty flag and the nodes' state. The conventions review held on the body's commit count, since corrected, and noted it did not run the lab itself.

CI on 98f59d6: all checks passed, with publish-service-api skipped. Auto-merge is enabled with the merge method, the only one the main ruleset allows. The ruleset requires one approving review, code owner review, and approval of the last push, so the PR waits for a human approval before it merges.

[ecv]

Approve.

Test-only change. Nothing in it reaches production, and the suite asserts isolation in both directions with positive controls.

• Nothing ships: publish.yaml builds named images from containers/*/Dockerfile and bundles only config/, so the fixture Dockerfile and the manifests under tests/edgeconformance/masqueprovider/deploy are never built or published. The image is built locally by the lab Taskfile and loaded with imagePullPolicy: Never.
• The unprivileged claim holds in the manifest (non-root 65532, drop: ["ALL"], allowPrivilegeEscalation: false, read-only root, no host namespaces or hostPath) and rowUnprivileged (masque_test.go:489-501) asserts it against the live pod, including no added capabilities and not privileged.
• Isolation is not vacuous: each tenant's workloads must answer at least 90% (positive control), echoes to the other tenant's workloads must be zero, the client must receive nothing that is not its own reply, and sniffers on all four workload links count foreign-tenant requests and must also see about half of their own tenant's requests. It runs cold, with flushed neighbor caches, and again after pod recreation.
• Credentials are random per run (rand.Text()), TLS material is generated per run, and the wrong-VPC credential case expects 403.
• acceptance.md is consistent with the suite: M16 and M07 map to M16-unprivileged-provider and M07-isolation, and the paragraph says a lab result does not satisfy rows that need the target platform.

Follow-ups:

• build:masque-provider joins the lab-wide build and load list, so every lab bring-up builds and loads this image onto the edge nodes. Consider making it opt-in with verify:masque-conformance.
• The suite takes about 15 minutes and is outside verify and CI, so nothing catches a regression until someone runs it. Worth a nightly job once the lab runner exists.