feat: carry a VPC pod to the edge only when served

Taskfile.test-infra.yml

@@ -414,6 +414,7 @@ tasks:
     desc: "Install the NSO CRDs the replicator mirrors into the downstream cluster (the Gateway-API/EG CRDs come from eg-crds)."
     cmds:
       - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/crd/bases/networking.datumapis.com_connectors.yaml
+      - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/crd/bases/networking.datumapis.com_edgereachabilities.yaml
       - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/crd/bases/networking.datumapis.com_httpproxies.yaml
       - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/crd/bases/networking.datumapis.com_trafficprotectionpolicies.yaml
       - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/crd/bases/networking.datumapis.com_servinglocations.yaml

api/v1alpha/edgereachability_types.go

@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package v1alpha
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EdgeReachabilityName is the name of the single record a namespace holds.
+// One record answers for the whole namespace, so a reader gets its answer with
+// a get rather than a list it has to decide is complete.
+const EdgeReachabilityName = "default"
+
+// EdgeReachabilitySpec is the set of workload addresses in one project
+// namespace that an edge is expected to reach.
+type EdgeReachabilitySpec struct {
+	// addresses are the workload addresses currently behind a proxy, one entry
+	// per address, with no prefix length. An empty list is a real answer: it
+	// says the project publishes nothing, which is different from no record at
+	// all.
+	//
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:MaxItems=8192
+	Addresses []string `json:"addresses,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// EdgeReachability records which of a project's workload addresses are behind
+// an HTTPProxy, so the platform carries a workload's location to the edges that
+// serve it and stops carrying it everywhere else.
+//
+// It is written by the control plane onto the federation hub and read by the
+// cells publishing into it. No consumer creates or edits one, and nothing in a
+// project control plane holds one.
+//
+// Absence of the record means the control plane has not answered for this
+// namespace yet, and a reader must keep publishing rather than treat silence as
+// a withdrawal. An empty list is the answer that withdraws.
+// +kubebuilder:printcolumn:name="Addresses",type=integer,JSONPath=".spec.addresses.length()"
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
+type EdgeReachability struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// +kubebuilder:validation:Optional
+	Spec EdgeReachabilitySpec `json:"spec,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// EdgeReachabilityList contains a list of EdgeReachability.
+type EdgeReachabilityList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []EdgeReachability `json:"items"`
+}

api/v1alpha/groupversion_info.go

@@ -26,6 +26,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(GroupVersion,
 		&Domain{},
 		&DomainList{},
+		&EdgeReachability{},
+		&EdgeReachabilityList{},
 		&HTTPProxy{},
 		&HTTPProxyList{},
 		&Location{},

config/crd/bases/networking.datumapis.com_edgereachabilities.yaml

@@ -0,0 +1,76 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.16.4
+  name: edgereachabilities.networking.datumapis.com
+spec:
+  group: networking.datumapis.com
+  names:
+    kind: EdgeReachability
+    listKind: EdgeReachabilityList
+    plural: edgereachabilities
+    singular: edgereachability
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.addresses.length()
+      name: Addresses
+      type: integer
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha
+    schema:
+      openAPIV3Schema:
+        description: |-
+          EdgeReachability records which of a project's workload addresses are behind
+          an HTTPProxy, so the platform carries a workload's location to the edges that
+          serve it and stops carrying it everywhere else.
+
+          It is written by the control plane onto the federation hub and read by the
+          cells publishing into it. No consumer creates or edits one, and nothing in a
+          project control plane holds one.
+
+          Absence of the record means the control plane has not answered for this
+          namespace yet, and a reader must keep publishing rather than treat silence as
+          a withdrawal. An empty list is the answer that withdraws.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: |-
+              EdgeReachabilitySpec is the set of workload addresses in one project
+              namespace that an edge is expected to reach.
+            properties:
+              addresses:
+                description: |-
+                  addresses are the workload addresses currently behind a proxy, one entry
+                  per address, with no prefix length. An empty list is a real answer: it
+                  says the project publishes nothing, which is different from no record at
+                  all.
+                items:
+                  type: string
+                maxItems: 8192
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources: {}

config/crd/downstream/kustomization.yaml

@@ -7,6 +7,11 @@
 # TrafficProtectionPolicy, HTTPProxy and Connector downstream, and the
 # extension server's cache reads them locally.
 #
+# Edge reachability: the control plane records, on the hub, which of a project's
+# workload addresses are behind a proxy, and the cells publishing into that
+# namespace read it to decide what to carry. It stops at the hub; no policy
+# carries it on.
+#
 # Network presence: a consumer writes a NetworkBinding on the hub, the control
 # plane manager turns every binding for a (network, location) pair into one
 # shared NetworkContext in the project control plane, the replicator mirrors
@@ -26,6 +31,7 @@
 # NetworkContext, Subnet, and ServingLocation on the local cluster.
 resources:
   # Gateway data plane
+  - ../bases/networking.datumapis.com_edgereachabilities.yaml
   - ../bases/networking.datumapis.com_trafficprotectionpolicies.yaml
   - ../bases/networking.datumapis.com_httpproxies.yaml
   - ../bases/networking.datumapis.com_connectors.yaml

config/rbac/role.yaml

@@ -242,6 +242,7 @@ rules:
   - connectoradvertisements
   - connectors
   - domains
+  - edgereachabilities
   - httpproxies
   - networkbindings
   - networkcontexts

config/rbac_downstream/role.yaml

@@ -182,3 +182,15 @@ rules:
   - envoypatchpolicies/status
   verbs:
   - get
+- apiGroups:
+  - networking.datumapis.com
+  resources:
+  - edgereachabilities
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch

internal/cmd/manager/manager.go

@@ -649,6 +649,14 @@ func controllerRegistrations(
 		{"networkservice", true, func() error {
 			return (&controller.NetworkServiceReconciler{}).SetupWithManager(mgr)
 		}},
+		// Which workloads are behind a proxy is only answerable in a project
+		// control plane, and only a cell can act on it. The record this writes to
+		// the hub is what carries the answer between them.
+		{"edgereachability", true, func() error {
+			return (&controller.EdgeReachabilityReconciler{
+				DownstreamCluster: deps.downstreamCluster,
+			}).SetupWithManager(mgr)
+		}},
 		{"subnet", true, func() error {
 			return (&controller.SubnetReconciler{}).SetupWithManager(mgr)
 		}},

internal/cmd/manager/manager_test.go

@@ -23,6 +23,7 @@ var reconcilerControllerNames = map[string]string{
 	"ConnectorAdvertisementReconciler":             "connectoradvertisement",
 	"ConnectorReconciler":                          "connector",
 	"DomainReconciler":                             "domain",
+	"EdgeReachabilityReconciler":                   "edgereachability",
 	"GatewayClassReconciler":                       "gatewayclass",
 	"GatewayDownstreamCertificateSolverReconciler": "downstream-certificate-solver",
 	"GatewayDownstreamGCReconciler":                "gateway_downstream_resources",