Add tests for cross-cloud sites over a private interconnect - #822
Open
Qi Ke (qike-ms) wants to merge 1 commit into
Open
Qi Ke (qike-ms) wants to merge 1 commit into
Qi Ke (qike-ms) wants to merge 1 commit into
Conversation
Azure Multicloud Interconnect, a DIY ExpressRoute plus Direct Connect stitch, and a site-to-site VPN are interchangeable here: each is a private L3 path where two sites reach each other by internal IP. Unbounded never provisions one, and a SitePeering is only the operator's assertion that it exists. Neither the encapsulation that follows from that assertion nor the IPAM it constrains was covered. encapsulation_test.go: an existing case pins GENEVE for a network-peered gateway peer, but nothing pinned the mesh peer that a cross-cloud node mesh uses. Assert that an explicit tunnelProtocol is honored, an unset one resolves through Auto to the private default, an explicit WireGuard still wins, and, as a control, the same peer with no SitePeering is an internet link and does force WireGuard. That control is the line a SitePeering moves. validation_test.go: both clouds hand out 10.0.0.0/16 by default and the interconnect carries the collision happily. Assert a disjoint plan is accepted, and that equality, a containing supernet, and duplicated pod ranges are rejected. One subtest documents a gap instead of desired behavior: node and pod CIDRs are validated in separate passes, so a pod CIDR carved out of the peer cloud's node range is admitted and fails later as unreachable routes. It is asserted as it behaves today and commented, so cross-cloud IPAM planners find it here rather than on the wire. Tests only, no production change.
Jason Wilder (jwilder)
approved these changes
Sep 19, 2026
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
One new encapsulation subtest doesn’t populate peeringSiteTunnelProtos in the “meshNodes=false” scenario, so it doesn’t actually validate the intended “explicit SitePeering tunnelProtocol is ignored” behavior.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Adds test coverage for cross-cloud “private interconnect” topologies, ensuring (a) encapsulation selection respects SitePeering vs internet-link behavior and (b) Site CIDR planning rejects overlapping node/pod ranges that would break cross-cloud routing.
Changes:
- Add cross-cloud tunnel protocol resolution tests to pin Auto vs explicit tunnelProtocol behavior for mesh peers, and include a “no SitePeering forces WireGuard” control.
- Add webhook validation tests covering cross-cloud node/pod CIDR overlap scenarios (including a documented current validation gap).
| File | Description |
|---|---|
internal/net/webhook/validation_test.go |
Adds cross-cloud Site CIDR planning tests for node/pod overlap validation behavior. |
cmd/unbounded-net-node/encapsulation_test.go |
Adds cross-cloud private-underlay tests for mesh peer tunnel protocol resolution with/without SitePeering. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+321
to
+332
| peeredSites := map[string]bool{localSite: true} | ||
| networkPeeredSites := map[string]bool{localSite: true, remoteSite: true} | ||
|
|
||
| peeringSiteTunnelProtos := map[string]string{} | ||
|
|
||
| if tt.meshNodes { | ||
| peeredSites[remoteSite] = true | ||
|
|
||
| if tt.peeringTunnel != "" { | ||
| peeringSiteTunnelProtos[remoteSite] = tt.peeringTunnel | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Azure Multicloud Interconnect, a DIY ExpressRoute plus Direct Connect stitch, and a site-to-site VPN are interchangeable here: each is a private L3 path where two sites reach each other by internal IP. Unbounded never provisions one, and a SitePeering is only the operator's assertion that it exists. Neither the encapsulation that follows from that assertion nor the IPAM it constrains was covered.
encapsulation_test.go: an existing case pins GENEVE for a network-peered gateway peer, but nothing pinned the mesh peer that a cross-cloud node mesh uses. Assert that an explicit tunnelProtocol is honored, an unset one resolves through Auto to the private default, an explicit WireGuard still wins, and, as a control, the same peer with no SitePeering is an internet link and does force WireGuard. That control is the line a SitePeering moves.
validation_test.go: both clouds hand out 10.0.0.0/16 by default and the interconnect carries the collision happily. Assert a disjoint plan is accepted, and that equality, a containing supernet, and duplicated pod ranges are rejected.
One subtest documents a gap instead of desired behavior: node and pod CIDRs are validated in separate passes, so a pod CIDR carved out of the peer cloud's node range is admitted and fails later as unreachable routes. It is asserted as it behaves today and commented, so cross-cloud IPAM planners find it here rather than on the wire.
Tests only, no production change.