Skip to content

Move Galactic VPC programming into NSO cell manager #662

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
scotwells merged 7 commits into from
Oct 16, 2026
Merged

Move Galactic VPC programming into NSO cell manager #662

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
8c50b29
Test NSO preservation of Galactic attachment API group
scotwells Oct 16, 2026
32431f5
Verify NSO preserves Galactic attachment migration status
scotwells Oct 16, 2026
c956eff
Merge remote-tracking branch 'origin/main' into codex/galactic-api-gr…
scotwells Oct 16, 2026
8368bb5
Move Galactic cell VPC programming into NSO
scotwells Oct 16, 2026
165f6c8
Regenerate dependency notices for Galactic API
scotwells Oct 16, 2026
17d8207
Guard Galactic controller registration by cell configuration
scotwells Oct 16, 2026
d5a204c
Resolve NSO lint failures after Galactic dependency update
scotwells Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1,284 changes: 1,218 additions & 66 deletions NOTICE
View file
Open in desktop

Large diffs are not rendered by default.

42 changes: 42 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,36 @@ rules:
- get
- patch
- update
- apiGroups:
- galactic.datumapis.com
resources:
- networkfabricidentities
verbs:
- get
- list
- watch
- apiGroups:
- galactic.datumapis.com
resources:
- vpcattachments
- vpcs
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- galactic.datumapis.com
resources:
- vpcattachments/status
- vpcs/status
verbs:
- get
- patch
- update
- apiGroups:
- gateway.envoyproxy.io
resources:
Expand Down Expand Up @@ -246,6 +276,18 @@ rules:
- get
- patch
- update
- apiGroups:
- k8s.cni.cncf.io
resources:
- network-attachment-definitions
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- locations.miloapis.com
resources:
Expand Down
10 changes: 5 additions & 5 deletions docs/enhancements/network-interfaces.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,7 +221,7 @@ status:
networkContextRef:
name: default-us-central-1
attachmentRef:
apiGroup: cloud.datumapis.com
apiGroup: galactic.datumapis.com
kind: VPCAttachment
name: nic-4f2a9c1e
vpc: 3kF9qP2x
Expand Down Expand Up @@ -399,7 +399,7 @@ status:

# The data-plane realization, once one exists.
attachmentRef:
apiGroup: cloud.datumapis.com
apiGroup: galactic.datumapis.com
kind: VPCAttachment
name: nic-4f2a9c1e

Expand Down Expand Up @@ -489,12 +489,12 @@ the allocator to preserve.
### Reaching the data plane

A `NetworkInterface` says what an interface must be. `VPCAttachment`, in the
[cloud](https://github.com/datum-cloud/cloud) API group, is where it becomes real, and the
`galactic.datumapis.com` API group, is where it becomes real, and the
split is deliberate: an interface is allocated as soon as a claim exists, before an instance
has been scheduled to any node, while what a node ends up carrying — a container ID, a host
device, a VRF — is only knowable once the sandbox exists.

The attachment is therefore **written as intent by the infrastructure provider and reported
The attachment is therefore **written as intent by NSO's cell manager and reported
on by the node**, not created by the node. It has to be, because the data plane reads it
before the sandbox exists: the CNI configuration a `VPCAttachment` produces must already be
in place when the pod's sandbox is created, so an attachment that only came into being as a
Expand All @@ -507,7 +507,7 @@ NetworkInterfaceClaim compute's intent created per instance, per interfac
NetworkInterface NSO's answer addresses, gateway, MTU
│ realized by
▼
VPCAttachment spec: the provider intent, written before the pod
VPCAttachment spec: NSO intent, written before the pod
│ status: the node node, containerID, VRF, host device
│ attaches to
▼
Expand Down
132 changes: 68 additions & 64 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,44 +6,46 @@ require (
github.com/alicebob/miniredis/v2 v2.35.0
github.com/cert-manager/cert-manager v1.17.2
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
github.com/domainr/whois v0.1.0
github.com/envoyproxy/gateway v1.8.1
github.com/envoyproxy/gateway/test v0.0.0-20260617000843-7e4492d9a99e
github.com/envoyproxy/go-control-plane/contrib v1.36.1-0.20260409050421-3f47accd6e14
github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260409050421-3f47accd6e14
github.com/go-logr/logr v1.4.3
github.com/go-logr/logr v1.4.4
github.com/go-redis/redis/v7 v7.4.1
github.com/google/cel-go v0.27.0
github.com/google/go-cmp v0.7.0
github.com/google/uuid v1.6.0
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3
github.com/k8snetworkplumbingwg/network-attachment-definition-client v1.7.7
github.com/kenshaw/baseconv v0.1.1
github.com/modelcontextprotocol/go-sdk v1.7.0
github.com/onsi/ginkgo/v2 v2.28.1
github.com/onsi/ginkgo/v2 v2.28.2
github.com/openrdap/rdap v0.9.1
github.com/prometheus/client_golang v1.23.2
github.com/prometheus/client_golang v1.25.0
github.com/spf13/cobra v1.10.2
github.com/stretchr/testify v1.11.1
github.com/stretchr/testify v1.12.1
go.datum.net/datumctl v0.18.1
go.datum.net/galactic v0.5.8-0.20261016143526-45d3c3514bec
go.miloapis.com/activity v0.7.1
go.miloapis.com/dns-operator v0.5.1
go.miloapis.com/locations v0.0.0-20260825185141-507ac2cbd48c
go.miloapis.com/locations v0.0.1
go.miloapis.com/milo v0.36.2
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
go.opentelemetry.io/otel v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
go.opentelemetry.io/otel/sdk v1.44.0
go.opentelemetry.io/otel/trace v1.44.0
golang.org/x/net v0.56.0
golang.org/x/sync v0.22.0
google.golang.org/grpc v1.81.1
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
k8s.io/api v0.36.1
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0
go.opentelemetry.io/otel v1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.47.0
go.opentelemetry.io/otel/sdk v1.47.0
go.opentelemetry.io/otel/trace v1.47.0
golang.org/x/net v0.61.0
golang.org/x/sync v0.24.0
google.golang.org/grpc v1.84.0
google.golang.org/protobuf v1.36.12
k8s.io/api v0.36.3
k8s.io/apiextensions-apiserver v0.36.1
k8s.io/apimachinery v0.36.1
k8s.io/client-go v0.36.1
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
k8s.io/apimachinery v0.36.3
k8s.io/client-go v0.36.3
k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
sigs.k8s.io/controller-runtime v0.24.1
sigs.k8s.io/gateway-api v1.5.1
sigs.k8s.io/gateway-api/conformance v1.5.1
Expand All @@ -53,11 +55,14 @@ require (

require (
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
github.com/go-openapi/swag/netutils v0.25.4 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/go-openapi/swag/cmdutils v0.28.0 // indirect
github.com/go-openapi/swag/netutils v0.28.0 // indirect
github.com/go-openapi/swag/pools v0.28.0 // indirect
github.com/google/jsonschema-go v0.4.3 // indirect
github.com/segmentio/encoding v0.5.4 // indirect
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
go.opentelemetry.io/otel/log v1.47.0 // indirect
)

require (
Expand Down Expand Up @@ -114,7 +119,7 @@ require (
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/chai2010/gettext-go v1.0.3 // indirect
github.com/cilium/ebpf v0.21.0 // indirect
github.com/cilium/ebpf v0.22.0 // indirect
github.com/containerd/cgroups/v3 v3.1.3 // indirect
github.com/containerd/containerd v1.7.32 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
Expand Down Expand Up @@ -152,24 +157,23 @@ require (
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-logr/zapr v1.3.0
github.com/go-ole/go-ole v1.3.0 // indirect
github.com/go-openapi/analysis v0.25.1 // indirect
github.com/go-openapi/errors v0.22.7 // indirect
github.com/go-openapi/jsonpointer v0.23.1 // indirect
github.com/go-openapi/jsonreference v0.21.6 // indirect
github.com/go-openapi/loads v0.23.3 // indirect
github.com/go-openapi/spec v0.22.5 // indirect
github.com/go-openapi/strfmt v0.26.3 // indirect
github.com/go-openapi/swag v0.25.4 // indirect
github.com/go-openapi/swag/conv v0.26.0 // indirect
github.com/go-openapi/swag/fileutils v0.26.0 // indirect
github.com/go-openapi/swag/jsonname v0.26.0 // indirect
github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
github.com/go-openapi/swag/loading v0.26.0 // indirect
github.com/go-openapi/swag/mangling v0.26.0 // indirect
github.com/go-openapi/swag/stringutils v0.26.0 // indirect
github.com/go-openapi/swag/typeutils v0.26.0 // indirect
github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
github.com/go-openapi/validate v0.25.3 // indirect
github.com/go-openapi/analysis v0.25.5 // indirect
github.com/go-openapi/errors v0.22.8 // indirect
github.com/go-openapi/jsonpointer v1.0.0 // indirect
github.com/go-openapi/jsonreference v1.0.0 // indirect
github.com/go-openapi/loads v0.25.0 // indirect
github.com/go-openapi/spec v0.22.9 // indirect
github.com/go-openapi/strfmt v0.27.0 // indirect
github.com/go-openapi/swag v0.28.0 // indirect
github.com/go-openapi/swag/conv v0.28.0 // indirect
github.com/go-openapi/swag/fileutils v0.28.0 // indirect
github.com/go-openapi/swag/jsonutils v0.28.0 // indirect
github.com/go-openapi/swag/loading v0.28.0 // indirect
github.com/go-openapi/swag/mangling v0.28.0 // indirect
github.com/go-openapi/swag/stringutils v0.28.0 // indirect
github.com/go-openapi/swag/typeutils v0.28.0 // indirect
github.com/go-openapi/swag/yamlutils v0.28.0 // indirect
github.com/go-openapi/validate v0.26.1 // indirect
github.com/go-sql-driver/mysql v1.10.0 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
Expand All @@ -187,7 +191,7 @@ require (
github.com/gorilla/handlers v1.5.2 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/gosuri/uitable v0.0.4 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/huandu/xstrings v1.5.0 // indirect
Expand All @@ -197,7 +201,7 @@ require (
github.com/jackc/pgx/v5 v5.9.2 // indirect
github.com/jmoiron/sqlx v1.4.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/compress v1.18.6 // indirect
github.com/klauspost/compress v1.20.1 // indirect
github.com/kortschak/goroutine v1.1.3 // indirect
github.com/kylelemons/godebug v1.1.0 // indirect
github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
Expand Down Expand Up @@ -243,10 +247,10 @@ require (
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.67.5 // indirect
github.com/prometheus/client_model v0.6.3
github.com/prometheus/common v0.72.0 // indirect
github.com/prometheus/otlptranslator v1.0.0 // indirect
github.com/prometheus/procfs v0.20.1 // indirect
github.com/prometheus/procfs v0.22.0 // indirect
github.com/quic-go/qpack v0.6.0 // indirect
github.com/quic-go/quic-go v0.59.1 // indirect
github.com/replicatedhq/troubleshoot v0.129.1 // indirect
Expand All @@ -268,7 +272,7 @@ require (
github.com/subosito/gotenv v1.6.0 // indirect
github.com/tklauser/go-sysconf v0.4.0 // indirect
github.com/tklauser/numcpus v0.12.0 // indirect
github.com/vishvananda/netlink v1.3.1 // indirect
github.com/vishvananda/netlink v1.3.2-0.20261002201547-1d1c62507e3c // indirect
github.com/vishvananda/netns v0.0.5 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
Expand All @@ -282,31 +286,31 @@ require (
go.miloapis.com/ipam v0.4.0
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 // indirect
go.opentelemetry.io/otel/exporters/prometheus v0.66.0 // indirect
go.opentelemetry.io/otel/metric v1.44.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
go.opentelemetry.io/otel/metric v1.47.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.47.0 // indirect
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.28.0
go.yaml.in/yaml/v2 v2.4.4 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.54.0 // indirect
go.yaml.in/yaml/v3 v3.0.5 // indirect
golang.org/x/crypto v0.58.0 // indirect
golang.org/x/crypto/x509roots/fallback v0.0.0-20250406160420-959f8f3db0fb // indirect
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
golang.org/x/mod v0.38.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/term v0.45.0
golang.org/x/text v0.40.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.47.0 // indirect
golang.org/x/mod v0.41.0 // indirect
golang.org/x/oauth2 v0.37.0 // indirect
golang.org/x/sys v0.49.0 // indirect
golang.org/x/term v0.47.0
golang.org/x/text v0.43.0 // indirect
golang.org/x/time v0.16.0 // indirect
golang.org/x/tools v0.51.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
Expand All @@ -319,7 +323,7 @@ require (
k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 // indirect
k8s.io/kubectl v0.36.1 // indirect
k8s.io/metrics v0.36.1 // indirect
k8s.io/streaming v0.36.1 // indirect
k8s.io/streaming v0.36.3 // indirect
oras.land/oras-go/v2 v2.6.0 // indirect
periph.io/x/host/v3 v3.8.5 // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
Expand All @@ -329,7 +333,7 @@ require (
sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
sigs.k8s.io/mcs-api v0.5.0 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.3 // indirect
)

replace sigs.k8s.io/multicluster-runtime => github.com/datum-cloud/multicluster-runtime v0.24.2-0.20261008054817-748176e5c835
Loading
Loading