Repository navigation
fix(cni): Report a node's own egress shard as local - #857
Merged
Merged
Conversation
In hashed egress mode, galactic-cni on a node that runs an egress shard
reported that shard as unreachable in every class. The node originates
the shard's locator itself, so the SID never resolves over an uplink
there. With one shard in the cluster, every shard node matched
GalacticEgressPoolEmpty although it has no tenant to egress.
A shard whose spec.targetRef names the node is now a local group member.
Its SID is not resolved, it is never alive, and pool_members reports it
as state="local". The datapath is unchanged: a local shard was never
alive before either, and ordered mode skips it the same way, by failing
to resolve it.
GalacticEgressPoolEmpty and GalacticEgressPoolBelowMinimum now require
routes on the group (galactic_cni_egress_group_routes > 0), so a node
with nothing to egress does not page. GalacticEgressClassUnserved counts
a local shard as able to serve its class. A remote shard that does not
resolve is still unreachable and still fires on a node with tenants.
Key changes:
- ShardCandidate.Local and a member flag for it; Apply skips resolving
a local shard, and Close and Members keep the flag
- egressShardCandidates marks the shard targeting this node as local
- pool_members{state="local"}; the unreachable warning skips it
- Alert rules scoped to nodes with group routes, with promtool cases for
a shard node and a node whose only remote shard is unreachable
- verify:nat-active-active checks each lab shard node reports its own
shard local and the other active
Fixes #856
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
privateip
changed the title
privateip
force-pushed
the
fix/egress-local-shard-not-unreachable
branch
from
October 13, 2026 16:07
66e0d73 to
c200b20
Compare
privateip
marked this pull request as ready for review
October 13, 2026 16:08
privateip
enabled auto-merge
October 13, 2026 16:08
scotwells
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #856.
galactic-cni now reports a node's own egress shard as local, not unreachable. Forwarding is unchanged, and the two pool alerts fire only on nodes with tenant routes on the shard group.
Testing
task lint,task buildandtask test:unitpass. New unit tests show a local shard is never resolved or alive and keeps its flag throughClose, and an unresolvable remote shard is still unreachable.promtool test rulespasses. A shard node with no tenants fires nothing, a node with no tenants whose remote shard is unreachable fires nothing, and a node with tenants and an unreachable shard still fires.task test:e2eandtask verify:nat-active-activewere not run because this environment has no Docker.The only datapath change is an unused
#define, sotask test:unit-rootwas not run.Important
Infra keeps a central copy of these rules. datum-cloud/infra#6955 tracks installing them, with runbook entries, after this merges.
🤖 Generated with Claude Code