Repository navigation
net: publish node assignments and replace stale agents - #916
Open
Patrick W. Healy (phealy) wants to merge 4 commits into
Open
Patrick W. Healy (phealy) wants to merge 4 commits into
Patrick W. Healy (phealy) wants to merge 4 commits into
Conversation
Patrick W. Healy (phealy)
added this pull request to stack #919
October 14, 2026 23:10
This was referenced Oct 14, 2026
Patrick W. Healy (phealy)
changed the title
This was referenced Oct 14, 2026
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Stale caches can trigger unnecessary agent deletion, and the name policy blocks cleanup of legacy GatewayPools.
2 open findings
What changed in this PR
Adds controller-published Node assignments and targeted agent replacement, preparing for agent adoption in #917.
Changes:
- Publishes GatewayPool labels with guarded patches and per-Node error isolation.
- Replaces agents whose acknowledged assignments are outdated.
- Adds admission restrictions, permissions, Pod identity fields, and tests.
| File | Description |
|---|---|
| internal/operator/components/net/vap_test.go | Tests assignment ownership and admission restrictions. |
| internal/operator/components/net/net_test.go | Updates operator plan expectations. |
| internal/net/controller/node_assignment_controller.go | Replaces agents with outdated acknowledgments. |
| internal/net/controller/node_assignment_controller_test.go | Tests replacement decisions and UID guards. |
| internal/net/controller/gatewaypool_helpers_test.go | Tests assignment publishing and error isolation. |
| internal/net/controller/gatewaypool_controller.go | Publishes guarded GatewayPool assignments. |
| deploy/net/node/rbac_test.go | Tests acknowledgment permissions and Pod identity. |
| deploy/net/node/03-daemonset.yaml.tmpl | Exposes Pod name and UID. |
| deploy/net/node/02-rbac.yaml.tmpl | Grants namespaced Pod acknowledgment permissions. |
| deploy/net/controller/rbac_test.go | Checks controller Pod deletion permission. |
| deploy/net/controller/09-vap.yaml.tmpl | Adds ownership, deletion, and pool-name restrictions. |
| deploy/net/controller/02-rbac.yaml.tmpl | Grants targeted agent deletion permission. |
| cmd/unbounded-net-controller/node_auth_informers.go | Indexes agent Pods by Node. |
| cmd/unbounded-net-controller/node_auth_informers_test.go | Verifies the Pod index. |
| cmd/unbounded-net-controller/main.go | Starts the assignment controller. |
| api/net/v1alpha1/types.go | Defines assignment labels and acknowledgment annotations. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Patrick W. Healy (phealy)
force-pushed
the
phealy/net-api-assignment-controller
branch
from
October 16, 2026 13:37
fd8c078 to
ec7ec76
Compare
Patrick W. Healy (phealy)
force-pushed
the
phealy/net-api-assignment-controller
branch
from
October 16, 2026 20:53
fb0d347 to
3958b4f
Compare
Patrick W. Healy (phealy)
marked this pull request as ready for review
October 16, 2026 23:50
Patrick W. Healy (phealy)
force-pushed
the
phealy/net-api-assignment-controller
branch
from
October 21, 2026 18:52
3958b4f to
ce40b57
Compare
Cameron Childress (cchildress)
previously approved these changes
Oct 21, 2026
Patrick W. Healy (phealy)
force-pushed
the
phealy/net-api-assignment-controller
branch
from
October 23, 2026 21:00
ce40b57 to
7634a27
Compare
Patrick W. Healy (phealy)
force-pushed
the
phealy/net-api-assignment-controller
branch
from
October 23, 2026 21:02
7634a27 to
2aa300b
Compare
Cameron Childress (cchildress)
approved these changes
Oct 23, 2026
Patrick W. Healy (phealy)
enabled stacked auto-merge
October 23, 2026 22:40
stacked auto-merge was automatically disabled
October 23, 2026 23:31
Auto-merge was disabled for another pull request in the stack
github-merge-queue
Bot
removed this pull request from the merge queue because a pull request earlier in the stack was removed
Oct 23, 2026
Add preferred GatewayPool labels, UID-safe targeted agent replacement, and the admission/RBAC contract for effective assignment acknowledgments. Node-side adoption follows in the next layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab9b78ee-42b8-4841-8d74-cd78d002d48b
Keep agent updates token-bound and prevent agent label and pod CIDR changes, allow only agent-owned annotations, and cover negative admission cases. Validate raw GatewayPool name length at admission and reconcile unaffected Nodes despite per-Node errors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab9b78ee-42b8-4841-8d74-cd78d002d48b
The Node and Pod informers are independent, so a cached Node can lag an agent that already acknowledged the live assignment. Confirm the mismatch against the live Node and Pod and delete with UID and resourceVersion preconditions. Check GatewayPool name length only on CREATE. Names are immutable, so existing longer pools must remain updatable to drain and finalize. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab9b78ee-42b8-4841-8d74-cd78d002d48b
Preserve same-key taints unless they are the exact managed gateway taint. Apply restricting policies and Deny bindings before namespace Pod permission expansions; propagate installation failures to dependent grants. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab9b78ee-42b8-4841-8d74-cd78d002d48b
Patrick W. Healy (phealy)
force-pushed
the
phealy/net-api-assignment-controller
branch
from
October 23, 2026 23:47
2aa300b to
d8ac5cc
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Have the controller publish each Node's assignment and replace only agents that are running with an outdated one.
wg-pubkey,tunnel-mtu,discovered-public-ipanddiscovered-public-ip-expires-at.The node agent side (adopting and acknowledging the assignment) is in #917. The controller is expected to be upgraded before the agent.
Testing
Stack
This is one of five stacked PRs that reduce API server load from unbounded-net-controller and unbounded-net-node. Kubernetes remains the source of truth. Review them bottom to top:
Motivation. A large cluster running v0.8.0 had the controller continuously writing objects that hadn't changed. Every node agent also watched the whole cluster's gateway topology. On a canary cluster, the full stack cut controller API calls by 54.4% and node agent API calls by 73.8%.