Merge feature/fix-egress-steering-banner (mark steering datapath live)

platform/vpn-egress/egress-steering.yaml

@@ -4,18 +4,16 @@
 # Serves: R-NET-05, R-NET-06, R-NET-07.
 #
 # ##########################################################################
-# ##  NOT WIRED INTO THE RUNTIME YET — DO NOT ADD TO kustomization.yaml   ##
-# ##  UNTIL THE HOST tun0 TUNNEL IS LIVE AND THIS DATAPATH IS VALIDATED.  ##
+# ##  LIVE (2026-08-24): wired into kustomization.yaml, reconciled by Flux ##
+# ##  and conformance-green (egress-class + vpn-killswitch pass on dev).   ##
 # ##########################################################################
 #
-# This policy steers vpn-class pods out a gateway node's host `tun0` interface. It is INERT and
-# potentially disruptive until the Ansible-managed host OpenVPN split-tunnel service actually exists
-# on a node labeled `homelab.keithjackson.dev/egress-gateway=true`. If Flux shipped this before the
-# tunnel is up, vpn-class pods would be SNAT'd to a non-existent interface — an unvalidated datapath.
-# Per platform/vpn-egress/README.md: "the steering datapath is intentionally NOT committed [to the
-# runtime kustomization] until the mechanism is chosen + validated." ADR-0015 chose the mechanism
-# (node tunnel + Cilium Egress Gateway); this file IS that datapath, authored but held out of the
-# resource list for the PM to enable after a live-tunnel validation (see TODO at the bottom).
+# This policy steers vpn-class pods out the gateway node's host `tun0` interface. It REQUIRES the
+# Ansible-managed host OpenVPN split-tunnel service on a node labeled
+# `homelab.keithjackson.dev/egress-gateway=true` — deploy that role BEFORE this policy reconciles, or
+# vpn-class pods are SNAT'd to a non-existent interface. The tunnel is live and validated end-to-end;
+# if tun0 is ever down, the host nftables kill-switch fails vpn-class CLOSED (see below). ADR-0015
+# chose this mechanism (node tunnel + Cilium Egress Gateway); this file IS that datapath.
 #
 # ---------------------------------------------------------------------------
 # PREREQUISITES CONFIRMED (2026-08-24):
@@ -74,15 +72,9 @@ spec:
         homelab.keithjackson.dev/egress-gateway: "true"
     interface: tun0
 # ---------------------------------------------------------------------------
-# TODO(PM — enable after live validation, then retire Gluetun):
-#   1. Confirm the Ansible host-tunnel role has brought `tun0` up on a node labeled
-#      homelab.keithjackson.dev/egress-gateway=true, and the host nftables kill-switch is in place.
-#   2. Add `- egress-steering.yaml` to platform/vpn-egress/kustomization.yaml so Flux ships it.
-#   3. Run the `egress-class` conformance test: vpn-class pod shows the PIA IP, internet-class shows
-#      the WAN IP, and a git label flip re-routes (R-NET-05/07).
-#   4. Run the `vpn-killswitch` conformance test: force tun0 down => vpn-class blackholed (no leak),
-#      internet-class unaffected (R-NET-06).
-#   5. Only AFTER both pass green: retire the Gluetun Deployment (remove gluetun-gateway.yaml from
-#      kustomization.yaml) per ADR-0015 ("Gluetun is dropped as the gateway"). Do NOT retire it in
-#      the same change that enables this — keep the validated fallback until steering is proven.
+# DONE (2026-08-24): enabled + validated + Gluetun retired.
+#   * Host tun0 split-tunnel is up on the egress-gateway node; host nftables kill-switch in place.
+#   * This file is wired into platform/vpn-egress/kustomization.yaml and reconciled by Flux.
+#   * `egress-class` (R-NET-05/07) and `vpn-killswitch` (R-NET-06) conformance tests PASS live.
+#   * The Gluetun Deployment was retired per ADR-0015 ("Gluetun is dropped as the gateway").
 # ---------------------------------------------------------------------------