Repository navigation
Conversation
This was referenced Oct 20, 2026
Collaborator
Author
|
Validation for this stack is on #949. |
privateip
force-pushed
the
feat/edge-attachment-datapath
branch
from
October 20, 2026 18:46
73d347c to
4984e0b
Compare
privateip
force-pushed
the
feat/edge-host-attachments
branch
from
October 20, 2026 18:46
a64c410 to
7d2526a
Compare
privateip
changed the title
privateip
force-pushed
the
feat/edge-host-attachments
branch
from
October 20, 2026 19:06
7d2526a to
e8b4ccb
Compare
privateip
force-pushed
the
feat/edge-attachment-datapath
branch
from
October 20, 2026 19:06
4984e0b to
35931cd
Compare
Add a root-only test that registers host-owned attachments with galactic's uSID datapath and exercises them against an independent SRv6 peer. Node X loads usid_ingress on its uplink and registers each workload and attachment host link through attachreg.RegisterDatapath, so the shared maps learn only host ifindexes and canonical tables; the pods behind them reuse the same pod-local table IDs and ifindexes. Node Y is built from the kernel's own reduced seg6 encapsulation and End.DT6 decapsulation, and carries workloads with the same address in both VPCs. Its attachment IDs fit the 16-bit field byte accounting decodes. The test checks that ifindex_vrf_table holds exactly the host attachment links and vrf_table resolves only to canonical tables, that a remote workload reaches a VRF-bound socket and a TUN consumer in its own VPC and gets the reply back through usid_egress encapsulation, that a 1280-byte IPv6 packet crosses the encapsulated path, and that same-node traffic between a workload and an attachment never leaves through the uplink. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A packet the uSID datapath decapsulates is redirected to its attachment's host link, and if it does not fit that link the decapsulation path drops it without sending Packet Too Big. An attachment therefore now has an MTU that applies to both ends of its veth pair, at least the IPv6 minimum of 1280, which callers set to the fabric's tenant MTU: the largest packet any interface of the VPC can send. A packet arriving over the fabric then always fits the host link. A narrower limit further in, such as a TUN device whose session carries less, is set through the TUN's own MTU, and the pod's kernel answers larger packets routed to it with Packet Too Big. Provision applies both MTUs to new and existing links and Readback reports a mismatch. The datapath test gives VPC A's TUN a 1400-byte MTU and checks that a remote workload sending a larger packet through the encapsulated path gets Packet Too Big with that MTU back, then succeeds at 1400 bytes. It also raises the tenant MTU to 1800 bytes and checks that a packet that large reaches an attachment over the fabric, and that the same packet is dropped without a reply when the host link is left at the 1500-byte default. The field documents that the MTU must not exceed what the underlay carries after encapsulation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
privateip
force-pushed
the
feat/edge-host-attachments
branch
from
October 20, 2026 19:34
e8b4ccb to
015048d
Compare
privateip
force-pushed
the
feat/edge-attachment-datapath
branch
from
October 20, 2026 19:34
35931cd to
a819e61
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Host-owned attachments have to work through galactic's real SRv6 datapath, not only plain kernel routing.
This registers attachment host links with the datapath the same way the CNI registers workloads, and checks remote traffic against an independent kernel SRv6 peer.
It also gives attachments an MTU equal to the tenant MTU, because the decapsulation path drops a packet too big for its egress link without telling the sender, while a narrower session behind the pod is reported by the pod's own forwarding.
Stack, bottom first:
Test plan
Related to #944
🤖 Generated with Claude Code