Support for default exposes #1198
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fredi-raspall
requested review from
qmonnet and
sergeymatov
and removed request for
a team and
sergeymatov
qmonnet
approved these changes
Jan 15, 2026
By policy, we no longer support overlap between peerings for exposed prefixes. This means that if VPC A exposes a given prefix to VPC B, then VPC C cannot expose an overlapping prefix (except for "default" destination prefixes, which will be handled differently). This means we can remove the code for overlap support from the flow-filter stage, along with related tests. The nat crate also contains some tests relying on the flow-filter stage behaviour for overlap, so we prune them as well. Signed-off-by: Quentin Monnet <qmo@qmon.net>
Following our change of policy regarding overlap in prefixes, we can remove the code that we added for the sole purpose of supporting overlapping IPs in crates nat and pkt-meta. We already removed some related code in a previous commit: here we remove the creation of a 3rd flow table entry for each connection, with an empty destination VPC discriminant, which would be used for lookup up the discriminant from the flow table, if relevant. We also remove the related check and destination VPC lookup attachment to packet metadata from the flow table lookup stage. The flow table lookup stage is now agnostic to the destination VPC for the packet. This reverts code from the following commits (all from Pull Request #1038): - 5abd3d9 ("feat(nat): Write destination VPC discriminant to flow table values") - 8c1282e ("feat(nat): Add 3rd stateful NAT session entry for destination VPC lookup") - d5a2c14 ("feat(pkt-meta): Move "unroutable" drop from dst VPC to flow lookup") Signed-off-by: Quentin Monnet <qmo@qmon.net>
Signed-off-by: Fredi Raspall <fredi@githedgehog.com>
Extends the conversion from CRD to internal type to allow the support of default exposes. A default expose cannot contain any ip/nots or nat configuration. Signed-off-by: Fredi Raspall <fredi@githedgehog.com>
Since we keep at most one config, there's no need to clear intermediate collections. Also, reorganize the code so that adding validations is clearer. Signed-off-by: Fredi Raspall <fredi@githedgehog.com>
- Forbid prefixes 0/0 or ::/0 in ip/nat/nots/as-not's in exposes - Do not allow default exposes to have ip/nat/nots/not-as Signed-off-by: Fredi Raspall <fredi@githedgehog.com>
Reorganize code so that we validate the `Peering` objects collected in Vpcs instead of the undirected `VpcPeering` objects learnt from the CRD. Signed-off-by: Fredi Raspall <fredi@githedgehog.com>
Adds a method to return the set of prefixes that should be advertised for an expose. Signed-off-by: Fredi Raspall <fredi@githedgehog.com>
Adapt the logic to determine prefixes to be advertised for a given peering expose. Signed-off-by: Fredi Raspall <fredi@githedgehog.com>
Signed-off-by: Fredi Raspall <fredi@githedgehog.com>
qmonnet
added a commit
that referenced
this pull request
Jan 16, 2026
Because the follow-up commits should be based on the changes from #1198, but we just need this tiny change to get the rest to compile.
Fredi-raspall
force-pushed
the
pr/fredi/expose_refined
branch
from
cfe7896 to
e08e39b
Compare
qmonnet
added a commit
that referenced
this pull request
Jan 17, 2026
Because the follow-up commits should be based on the changes from #1198, but we just need this tiny change to get the rest to compile.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
defaultflag fabricator#1313 gets merged (?)