Repository navigation
fix: Place the gateway and NAT on edge nodes - #747
Conversation
The gateway and NAT bases refused any node carrying a galactic.datumapis.com/node label, to keep them off the node=edge nodes where galactic-vrf runs. Egress shards always run on edge nodes, and infra overrides both affinities to node=edge already, so the repository's manifests, placement test, docs and lab described a layout nothing deploys. The XDP sharing that kept them apart is now the shared dispatcher (#742, #743), and #711 covers the shard SID overlap. - Both bases require node In [edge] and their own opt-in label, gateway=enabled or nat=enabled, and still refuse control-plane nodes. - The placement test accepts an edge node with either or both opt-in labels and refuses an edge node with neither, opt-in labels without node=edge, compute, unlabelled and control-plane nodes, and a wrong label value. It fails against the old manifests. - The node-label doc, AGENTS.md, the gateway and NAT configuration docs and the gateway architecture doc describe the new rule, and the migration steps say to add node=edge before applying the new manifests. - The lab's edge workers carry node=edge. Kind applies labels only at cluster creation, so a running lab needs them added by hand. Running the gateway in the lab is #699. Fixes #718 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The metrics reference said the two could share the 9182 default because they never share a node. Both now run on edge nodes. They still do not clash, because galactic-vrf runs in the ingress proxy's pod, which has its own network namespace, while galactic-nat binds 9182 on the node. Related to #718 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
148f732 to
9975c29
Compare
|
pr-rereviewer confirmed all fixes and the migration claim against both affinities. pr-conventions-reviewer noted landing order dependencies (#746, #749) but the author chose to ready #747 with auto-merge now, deferring rebase if needed. The merge kept #745's dispatcher text with no chain-mode text. Reviewers ran: pr-adversary (diff, go test ./internal/manifests, stale-claim greps); pr-conventions-reviewer (landing order check, phrase table scan). Findings applied before this phase: docs/metrics.md reworded to clarify that galactic-vrf's pod has its own network namespace; PR body updated with links to infra's template overrides; rebased onto main after #745 merged with conflicts in AGENTS.md and docs/node-labels.md resolved; migration section corrected to document that old and new manifests' conflicting affinity rules mean a running lab must label its edge workers before applying the new NAT manifest, or the shards are removed until it is. CI: Unit Tests (root), Unit Tests, Build, and Lint all pass. Image builds in progress. Ruleset requires one code-owner approval; auto-merge waits for that approval on the current head. Merge method: merge (first allowed by main's ruleset). Auto-merge enabled and will land once code-owner approval is posted. |
2 participants
Summary
The gateway and NAT manifests refuse any node with a node role label, but egress shards always run on edge nodes and infra already overrides that rule in its galactic-nat and galactic-gateway templates, so the manifests, placement test, docs and lab describe a layout nothing deploys.
Both now require an edge node plus their own opt-in label, and still refuse control-plane nodes. Production is unaffected, since infra sets its own placement.
A running lab needs the edge label on its edge workers before the new NAT manifest applies, or the shards are removed until it is.
Test plan
Fixes #718
🤖 Generated with Claude Code