Gate the network on Prepared, never on Programmed

[scotwells]

The Network scheduling gate now waits for the data plane to be ready to receive a Pod, and still never waits for the attachment itself.

networkInterfaceClaimSatisfied becomes Bound + Allocated + Prepared. Prepared means the data plane's pre-Pod artifacts exist, so a Pod created now can be attached. It becomes true before any Pod exists, which is what makes waiting on it safe.

Programmed stays excluded, permanently, and the function now says why at length — the deadlock argument is the reason the two conditions exist separately. Programmed becomes true when the interface is attached at sandbox creation, and the infrastructure provider defers creating the Pod while any scheduling gate remains, so a gate waiting on Programmed waits on itself: no Pod, no attachment; no attachment, no Programmed. It reaches consumers through Instance.status.networkInterfaces[].conditions, which is already mirrored.

Two paired tests keep both halves honest: a claim with Programmed False or Unknown still releases the gate, and a claim with Prepared False or Unknown does not. Prepared also joins the conditions mirrored onto Instance status and the reasons surfaced when a claim is refused, so a stuck instance says why instead of sitting gated in silence.

The condition type comes from NSO rather than being repeated here as a string. A duplicated condition literal fails closed and quiet — rename it upstream and compute simply never finds the condition, reads it as not-True, and holds every networked instance with no error naming the cause.

Before this merges

The network-services-operator pin points at main, not a branch — datum-cloud/network-services-operator#393 has merged. The latest tag still predates the Prepared condition, so re-pin once a release carries it.

Do not merge until the VPC controller is deployed in every cell running the networking integration. Nothing writes Prepared today, so merging first leaves every networked instance gated indefinitely, with no error naming the cause.

Related

• Umbrellas: Integrate IPAM and compute networking interface network-services-operator#164, Integrate with network services operator for IP address assignment #112
• Defines the condition, and the pin to move: Add a Prepared condition, and attachmentMode on the claim network-services-operator#393
• First consumer, and what must be deployed first: feat(vpc): add the VPC controller that realizes attachments on the data plane cloud#6
• Sibling: Publish the bound NetworkInterface on Instance status #245

🤖 Generated with Claude Code