Repository navigation
test(edge): Enforce traffic policy on pod VPC attachment links - #951
Merged
privateip merged 1 commit intoOct 22, 2026
Merged
Conversation
This was referenced Oct 20, 2026
Collaborator
Author
|
Validation for this stack is on #949. |
privateip
force-pushed
the
feat/edge-attachment-policy
branch
from
October 20, 2026 18:46
5afb9c4 to
1c11628
Compare
privateip
changed the title
privateip
force-pushed
the
feat/edge-attachment-policy
branch
from
October 20, 2026 19:06
1c11628 to
9bc772f
Compare
privateip
force-pushed
the
feat/edge-attachment-policy
branch
from
October 20, 2026 19:34
9bc772f to
b382354
Compare
privateip
marked this pull request as ready for review
October 22, 2026 02:34
privateip
added this pull request to stack #987
October 22, 2026 02:37
Host-owned attachment links must not bypass interface traffic policy. This test gives each attachment's host link exactly what galactic-bgp and galactic-router give an ordinary workload interface: a tp_iface_table row with its own policy token, tp_deliver on the host link, and a compiled snapshot bound per direction, with the node in enforce mode. It checks that an attachment with no binding denies remote traffic and counts it as policy_unavailable; that a bound policy admits a VRF-bound socket's inbound connections and replies; that changing either direction's policy to deny takes effect on the next connection and changing it back restores service; and that a TUN consumer's echo requests and replies are decided separately per direction. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
privateip
force-pushed
the
feat/edge-attachment-policy
branch
from
October 22, 2026 03:02
b382354 to
9f8ad89
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Attachment links must not bypass interface traffic policy.
This test gives each attachment link the same policy row, token, delivery filter and per-direction snapshots an ordinary workload interface gets, with the node enforcing. No production code changes.
Stack, bottom first:
Test plan
Related to #944
🤖 Generated with Claude Code
MASQUE epic tracking
Contributes to #979. These are partial contributions; this PR does not close those issues.
Foundation epic tracking
Contributes to #999. These are partial contributions; this PR does not close those issues.