feat: a cell tells compute which location it serves

api/v1alpha/instance_types.go

@@ -838,10 +838,23 @@ const (
 	WorkloadReasonNetworkNotFound = "NetworkNotFound"
 
 	// WorkloadDeploymentReasonNoMatchingLocation is set on WorkloadDeployment.Available
-	// while no Location matches the deployment's city code. The message names the
-	// unresolved city; network provisioning cannot start until that Location exists.
+	// while the cell has not been told which location it serves, so the deployment
+	// cannot be given one. The value is kept for compatibility with clients that
+	// already match on it.
 	WorkloadDeploymentReasonNoMatchingLocation = "NoMatchingLocation"
 
+	// WorkloadDeploymentReasonAmbiguousServingLocation is set on
+	// WorkloadDeployment.Available when more than one location has been delivered
+	// to the cell. The cell will not guess which one it serves, so the deployment
+	// waits until the platform resolves the conflict.
+	WorkloadDeploymentReasonAmbiguousServingLocation = "AmbiguousServingLocation"
+
+	// WorkloadDeploymentReasonCityCodeMismatch is set on
+	// WorkloadDeployment.Available when the deployment asks for one city and the
+	// cell serves another. It means the deployment was placed on the wrong cell,
+	// which is a platform fault rather than anything the user can correct.
+	WorkloadDeploymentReasonCityCodeMismatch = "CityCodeMismatch"
+
 	// WorkloadDeploymentReasonNetworkProvisioning is set on WorkloadDeployment.Available
 	// while the network binding or subnet is still being provisioned.
 	// Replaces the previously-emitted inline literal "ProvisioningNetwork".

config/base/crd/bases/compute.datumapis.com_instances.yaml

@@ -97,12 +97,8 @@ spec:
                   name:
                     description: Name of a datum location
                     type: string
-                  namespace:
-                    description: Namespace for the datum location
-                    type: string
                 required:
                 - name
-                - namespace
                 type: object
               networkInterfaces:
                 description: |-

config/base/crd/bases/compute.datumapis.com_workloaddeployments.yaml

@@ -210,12 +210,8 @@ spec:
                           name:
                             description: Name of a datum location
                             type: string
-                          namespace:
-                            description: Namespace for the datum location
-                            type: string
                         required:
                         - name
-                        - namespace
                         type: object
                       networkInterfaces:
                         description: |-
@@ -1281,12 +1277,8 @@ spec:
                   name:
                     description: Name of a datum location
                     type: string
-                  namespace:
-                    description: Namespace for the datum location
-                    type: string
                 required:
                 - name
-                - namespace
                 type: object
               observedGeneration:
                 description: |-

config/base/crd/bases/compute.datumapis.com_workloads.yaml

@@ -214,12 +214,8 @@ spec:
                           name:
                             description: Name of a datum location
                             type: string
-                          namespace:
-                            description: Namespace for the datum location
-                            type: string
                         required:
                         - name
-                        - namespace
                         type: object
                       networkInterfaces:
                         description: |-

config/components/controller_rbac/role.yaml

@@ -79,24 +79,24 @@ rules:
 - apiGroups:
   - networking.datumapis.com
   resources:
-  - locations
-  - networkinterfaces
-  - networks
+  - networkinterfaceclaims
   verbs:
+  - create
+  - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - networking.datumapis.com
   resources:
-  - networkinterfaceclaims
+  - networkinterfaces
+  - networks
+  - servinglocations
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - quota.miloapis.com

go.mod

@@ -10,9 +10,11 @@ require (
 	github.com/onsi/gomega v1.42.1
 	github.com/prometheus/client_golang v1.23.2
 	github.com/stretchr/testify v1.11.1
-	// TODO: temporary pin to the NetworkInterfaceClaim branch (datum-cloud/network-services-operator#360).
-	// Re-pin to a tagged release before merging.
-	go.datum.net/network-services-operator v0.25.6-0.20260813185515-6a019e3fd9b8
+	// TODO: temporary pin to network-services-operator main. The latest tag
+	// (v0.25.5) predates NetworkInterfaceClaim (#360), ServingLocation (#372),
+	// and per-location networks (#373); re-pin to a tagged release before
+	// compute cuts a release.
+	go.datum.net/network-services-operator v0.25.6-0.20260814125050-f3a972d9da33
 	go.miloapis.com/milo v0.32.0
 	golang.org/x/crypto v0.54.0
 	golang.org/x/sync v0.22.0
@@ -112,13 +114,13 @@ require (
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.36.1
+	k8s.io/apiextensions-apiserver v0.36.1 // indirect
 	k8s.io/apiserver v0.36.1 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
-	sigs.k8s.io/yaml v1.6.0
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )

go.sum

@@ -175,8 +175,8 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-go.datum.net/network-services-operator v0.25.6-0.20260813185515-6a019e3fd9b8 h1:R82aXI8iC+6JMm5WjLxpBJRgRTPUACLlvxOW4svZ03Y=
-go.datum.net/network-services-operator v0.25.6-0.20260813185515-6a019e3fd9b8/go.mod h1:oz57/uTB5HAjLGrqs1pn1HTP/jW9vkGgMODPvCiUlvc=
+go.datum.net/network-services-operator v0.25.6-0.20260814125050-f3a972d9da33 h1:oAbsJRV6zNrwO7XymY2WJ7+uAa+PBx9mNeXbo48CQgk=
+go.datum.net/network-services-operator v0.25.6-0.20260814125050-f3a972d9da33/go.mod h1:oz57/uTB5HAjLGrqs1pn1HTP/jW9vkGgMODPvCiUlvc=
 go.miloapis.com/milo v0.32.0 h1:TkNIQu/37d+SEquLJ5+GmdisSl+K2RT7eEC4idg6RIs=
 go.miloapis.com/milo v0.32.0/go.mod h1:GKK3afjCwshfZfvhjNe1wp/H45z4m7x5oG/8xbSgU1M=
 go.miloapis.com/service-catalog v0.4.0 h1:LvO1WCHMCoFokpS5igWMP8kyqly9gUFQmQj5IGhwuKs=

internal/controller/indexers.go

@@ -16,10 +16,6 @@ import (
 const (
 	deploymentWorkloadUIDIndex = "deploymentWorkloadUIDIndex"
 	workloadNetworksIndex      = "workloadNetworksIndex"
-	// deploymentCityCodeIndex indexes WorkloadDeployments by their Spec.CityCode
-	// so that the Location watch can efficiently find the deployments targeting
-	// the city a changed Location serves.
-	deploymentCityCodeIndex = "deploymentCityCodeIndex"
 
 	deploymentLocationIndex = "deploymentLocationIndex"
 
@@ -55,10 +51,6 @@ func addWorkloadDeploymentIndexers(ctx context.Context, mgr mcmanager.Manager) e
 		return fmt.Errorf("failed to add workload deployment indexer %q: %w", deploymentWorkloadUIDIndex, err)
 	}
 
-	if err := mgr.GetFieldIndexer().IndexField(ctx, &computev1alpha.WorkloadDeployment{}, deploymentCityCodeIndex, deploymentCityCodeIndexFunc); err != nil {
-		return fmt.Errorf("failed to add workload deployment indexer %q: %w", deploymentCityCodeIndex, err)
-	}
-
 	// Index workload deployments by location
 	if err := mgr.GetFieldIndexer().IndexField(ctx, &computev1alpha.WorkloadDeployment{}, deploymentLocationIndex, deploymentLocationIndexFunc); err != nil {
 		return fmt.Errorf("failed to add workload deployment indexer %q: %w", deploymentLocationIndex, err)
@@ -79,34 +71,22 @@ func addWorkloadDeploymentIndexers(ctx context.Context, mgr mcmanager.Manager) e
 func deploymentWorkloadUIDIndexFunc(o client.Object) []string {
 	// Skip deployments without a workload UID: indexing them under the empty
 	// key would make them matchable by a GC query built from a corrupt (empty)
-	// UID, mirroring deploymentCityCodeIndexFunc.
+	// UID.
 	uid := string(o.(*computev1alpha.WorkloadDeployment).Spec.WorkloadRef.UID)
 	if uid == "" {
 		return nil
 	}
 	return []string{uid}
 }
 
-func deploymentCityCodeIndexFunc(o client.Object) []string {
-	deployment := o.(*computev1alpha.WorkloadDeployment)
-	if deployment.Spec.CityCode == "" {
-		return nil
-	}
-	return []string{deployment.Spec.CityCode}
-}
-
 func deploymentLocationIndexFunc(o client.Object) []string {
 	deployment := o.(*computev1alpha.WorkloadDeployment)
 	if deployment.Status.Location == nil {
 		return nil
 	}
 
-	return []string{
-		types.NamespacedName{
-			Namespace: deployment.Status.Location.Namespace,
-			Name:      deployment.Status.Location.Name,
-		}.String(),
-	}
+	// Locations are cluster-scoped, so the name alone identifies one.
+	return []string{deployment.Status.Location.Name}
 }
 
 func addWorkloadIndexers(ctx context.Context, mgr mcmanager.Manager) error {

internal/controller/instancecontrol/stateful/stateful_control_test.go

@@ -338,8 +338,7 @@ func TestInstanceLocation_SetWhenDeploymentStatusLocationPresent(t *testing.T) {
 
 	deployment := getWorkloadDeployment("test-location-set", 1)
 	deployment.Status.Location = &networkingv1alpha.LocationReference{
-		Name:      "loc-dfw-1",
-		Namespace: "networking-system",
+		Name: "loc-dfw-1",
 	}
 
 	var currentInstances []v1alpha.Instance
@@ -353,7 +352,6 @@ func TestInstanceLocation_SetWhenDeploymentStatusLocationPresent(t *testing.T) {
 	assert.NotNil(t, instance.Spec.Location,
 		"Spec.Location must be set when deployment.Status.Location is non-nil")
 	assert.Equal(t, "loc-dfw-1", instance.Spec.Location.Name)
-	assert.Equal(t, "networking-system", instance.Spec.Location.Namespace)
 }
 
 // TestInstanceLocation_NilWhenDeploymentStatusLocationAbsent verifies that when

internal/controller/workload_controller.go

@@ -460,7 +460,7 @@ func (r *WorkloadReconciler) getDeploymentsForWorkload(
 		for _, cityCode := range placement.CityCodes {
 			foundLocation := false
 			for _, location := range locations.Items {
-				locationCityCode, ok := location.Spec.Topology["topology.datum.net/city-code"]
+				locationCityCode, ok := location.Spec.Topology[networkingv1alpha.TopologyCityCodeKey]
 				if ok && cityCode == locationCityCode {
 					foundLocation = true
 					break