Repository navigation
feat: Only send load balancer traffic to verified backends - #714
Conversation
|
|
8162a4b to
b5007d9
Compare
kevwilliams
left a comment
kevwilliams
left a comment
There was a problem hiding this comment.
Verified tenant roles cannot create or patch NetworkInterfaces, projection always overwrites source labels, and endpoints drive only status, so no traffic flows yet.
Keep the original interface identity through projection so a serving location can confirm a backend still belongs to the right VPC before it sends it traffic. Backends without a verified identity are left out. Key changes: - Preserve the source interface UID on projected interfaces - Exclude route endpoints without a verified source identity - Document the serving-location contract
b5007d9 to
3de154b
Compare
kevwilliams
left a comment
kevwilliams
left a comment
There was a problem hiding this comment.
Re-verified after rebase: patch is unchanged, and removing the empty source-UID check or the UID label still fails the tests.
ecv
left a comment
ecv
left a comment
There was a problem hiding this comment.
Approve.
Rebase only onto c1ca2cf: git range-diff shows the commit unchanged, so the verdict at b5007d9 stands.
Copies published before this lands carry no source-uid label, so every existing backend drops out until the cell republishes it.
That is safe because nothing serves yet, and the doc says so.
Stack: based on #713, merge after it.
Summary
Load balancers now only use backends whose network identity can be verified. That lets each serving location confirm a backend still belongs to the right VPC before it sends it traffic. Backends that can't be verified are left out. This doesn't yet mark routes ready or announce addresses.
Test plan
Depends on #713. Replaces #627. Related to #611 and datum-cloud/enhancements#884