From b6e8adc6c65efa87a9b06ddc135a2520bbf29d46 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 24 Aug 2026 14:53:39 -0500 Subject: [PATCH] docs: mark egress-steering.yaml as live (remove stale NOT-WIRED banner + done TODO) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The policy is wired into the kustomization, reconciled by Flux, and conformance-green; gluetun is retired. Update the header banner + bottom checklist to reflect that. Comment-only — the CiliumEgressGatewayPolicy spec is unchanged. Co-Authored-By: Claude Opus 4.8 --- platform/vpn-egress/egress-steering.yaml | 34 +++++++++--------------- 1 file changed, 13 insertions(+), 21 deletions(-) diff --git a/platform/vpn-egress/egress-steering.yaml b/platform/vpn-egress/egress-steering.yaml index 6112502..7542bf7 100644 --- a/platform/vpn-egress/egress-steering.yaml +++ b/platform/vpn-egress/egress-steering.yaml @@ -4,18 +4,16 @@ # Serves: R-NET-05, R-NET-06, R-NET-07. # # ########################################################################## -# ## NOT WIRED INTO THE RUNTIME YET — DO NOT ADD TO kustomization.yaml ## -# ## UNTIL THE HOST tun0 TUNNEL IS LIVE AND THIS DATAPATH IS VALIDATED. ## +# ## LIVE (2026-08-24): wired into kustomization.yaml, reconciled by Flux ## +# ## and conformance-green (egress-class + vpn-killswitch pass on dev). ## # ########################################################################## # -# This policy steers vpn-class pods out a gateway node's host `tun0` interface. It is INERT and -# potentially disruptive until the Ansible-managed host OpenVPN split-tunnel service actually exists -# on a node labeled `homelab.keithjackson.dev/egress-gateway=true`. If Flux shipped this before the -# tunnel is up, vpn-class pods would be SNAT'd to a non-existent interface — an unvalidated datapath. -# Per platform/vpn-egress/README.md: "the steering datapath is intentionally NOT committed [to the -# runtime kustomization] until the mechanism is chosen + validated." ADR-0015 chose the mechanism -# (node tunnel + Cilium Egress Gateway); this file IS that datapath, authored but held out of the -# resource list for the PM to enable after a live-tunnel validation (see TODO at the bottom). +# This policy steers vpn-class pods out the gateway node's host `tun0` interface. It REQUIRES the +# Ansible-managed host OpenVPN split-tunnel service on a node labeled +# `homelab.keithjackson.dev/egress-gateway=true` — deploy that role BEFORE this policy reconciles, or +# vpn-class pods are SNAT'd to a non-existent interface. The tunnel is live and validated end-to-end; +# if tun0 is ever down, the host nftables kill-switch fails vpn-class CLOSED (see below). ADR-0015 +# chose this mechanism (node tunnel + Cilium Egress Gateway); this file IS that datapath. # # --------------------------------------------------------------------------- # PREREQUISITES CONFIRMED (2026-08-24): @@ -74,15 +72,9 @@ spec: homelab.keithjackson.dev/egress-gateway: "true" interface: tun0 # --------------------------------------------------------------------------- -# TODO(PM — enable after live validation, then retire Gluetun): -# 1. Confirm the Ansible host-tunnel role has brought `tun0` up on a node labeled -# homelab.keithjackson.dev/egress-gateway=true, and the host nftables kill-switch is in place. -# 2. Add `- egress-steering.yaml` to platform/vpn-egress/kustomization.yaml so Flux ships it. -# 3. Run the `egress-class` conformance test: vpn-class pod shows the PIA IP, internet-class shows -# the WAN IP, and a git label flip re-routes (R-NET-05/07). -# 4. Run the `vpn-killswitch` conformance test: force tun0 down => vpn-class blackholed (no leak), -# internet-class unaffected (R-NET-06). -# 5. Only AFTER both pass green: retire the Gluetun Deployment (remove gluetun-gateway.yaml from -# kustomization.yaml) per ADR-0015 ("Gluetun is dropped as the gateway"). Do NOT retire it in -# the same change that enables this — keep the validated fallback until steering is proven. +# DONE (2026-08-24): enabled + validated + Gluetun retired. +# * Host tun0 split-tunnel is up on the egress-gateway node; host nftables kill-switch in place. +# * This file is wired into platform/vpn-egress/kustomization.yaml and reconciled by Flux. +# * `egress-class` (R-NET-05/07) and `vpn-killswitch` (R-NET-06) conformance tests PASS live. +# * The Gluetun Deployment was retired per ADR-0015 ("Gluetun is dropped as the gateway"). # ---------------------------------------------------------------------------