feat(api): add Flat VPC virtualization type for zero-DPU hosts

crates/agent/src/nvue.rs

@@ -41,6 +41,18 @@ pub fn template_for(vtype: VpcVirtualizationType) -> eyre::Result<&'static str>
         VpcVirtualizationType::EthernetVirtualizer
         | VpcVirtualizationType::EthernetVirtualizerWithNvue => Ok(TMPL_ETV_WITH_NVUE),
         VpcVirtualizationType::Fnn => Ok(TMPL_FNN),
+        // Flat VPCs attach instances via a plain NIC (the host's
+        // primary fabric interface is not a DPU), so there's no NVUE
+        // template to render for them -- this function is the DPU
+        // agent's template selector, and Flat instances don't run
+        // through a DPU agent at all.
+        //
+        // (NICo today doesn't model mixed-mode hosts that have a NIC
+        // primary plus secondary DPUs used for VFs; if that ever
+        // becomes a target, the dispatch here would need rethinking.)
+        VpcVirtualizationType::Flat => {
+            Err(eyre::eyre!("Flat VPC virtualization type not supported",))
+        }
     }
 }
 

crates/api-db/migrations/20260518165405_flat_network_virtualization_type.sql

@@ -0,0 +1,14 @@
+---
+--- 20260518165405_flat_network_virtualization_type.sql
+---
+--- Adds a third network virtualization type, `flat`, for VPCs whose tenant
+--- instances live directly on the underlay (no DPU, or DPU in NIC mode) and
+--- whose interfaces sit on `HostInband` network segments rather than a
+--- NICo-managed overlay. Flat VPCs are still real tenant VPCs -- they
+--- have a VNI, support NSGs (as descriptive metadata for pluggable SDN
+--- hooks), and can peer with ETV/FNN VPCs -- but NICo doesn't drive
+--- their data plane. Routing and ACL enforcement between Flat VPCs and
+--- other VPCs is the network operator's responsibility.
+---
+
+ALTER TYPE network_virtualization_type_t ADD VALUE 'flat';

crates/api-integration-tests/tests/lib.rs

@@ -111,7 +111,11 @@ async fn test_integration() -> eyre::Result<()> {
     let domain_id = domain::create(carbide_api_addrs, "tenant-1.local").await?;
     let managed_segment_id =
         subnet::create(carbide_api_addrs, &tenant1_vpc, &domain_id, 10, false).await?;
-    subnet::create(carbide_api_addrs, &tenant1_vpc, &domain_id, 11, true).await?;
+
+    // HostInband segments must live in a Flat VPC -- those VPC types are
+    // mutually bound. Create one for the HostInband fixture.
+    let flat_vpc = vpc::create_flat(carbide_api_addrs, tenant_org_id).await?;
+    subnet::create(carbide_api_addrs, &flat_vpc, &domain_id, 11, true).await?;
 
     // Create FNN VPC + VPC prefixes (IPv4 + IPv6) for dual-stack L3 linknet testing.
     let fnn_vpc = vpc::create_fnn(carbide_api_addrs, tenant_org_id).await?;