Repository navigation
docs(design-proposals): add Proxmox tenant networks - #104
Marian Koreniuk (themoriarti) wants to merge 3 commits into
Conversation
On a Proxmox-backed tenant cluster the tenant still picks the bridge, the VLAN and the address range of its worker VMs, so nothing keeps one tenant off another tenant's VLAN. The proposal lets the platform own them without a controller: an admin-written zone lists the networks of each namespace, the package chart renders one InClusterIPPool per network, and a ValidatingAdmissionPolicy with the zone as its parameter keeps capmox machine NICs and the ProxmoxCluster pool on the namespace's own networks. It adds no Kube-OVN objects and no OVN writes. It is the smaller first piece split out of cozystack#93, which becomes the follow-up for VPC-backed subnets. Assisted-by: LLM Signed-off-by: Marian Koreniuk <moriarti@cp.if.ua>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
…space, name) unique The proposal listed (namespace, name) among the CEL validations of the zone CRD. The CRD keeps it unique through the list-map key of networks instead, so the apiserver does it without a rule whose cost grows with the square of the table; the text now says which mechanism it is. Assisted-by: LLM Signed-off-by: Marian Koreniuk <moriarti@cp.if.ua>
|
The implementation is open as a draft: cozystack/cozystack#5047. It is the eight commits this proposal describes, one per area, on top of One correction to the text here, pushed to this branch: ( |
|
Hi! We removed Sorry for the extra work, I wanted to mention this now so it doesn't come up late in review. |
The proposal conventions no longer keep these fields; status and dates come from the introducing PR's history. Assisted-by: LLM Signed-off-by: Marian Koreniuk <moriarti@cp.if.ua>
|
Done in ae9113b, thanks for the heads-up. |
Design proposal for Proxmox tenant networks: the platform, not tenant values, owns the bridge, the VLAN and the IP pool of the VMs behind a Proxmox-backed tenant cluster, and a ValidatingAdmissionPolicy with the zone as its parameter keeps capmox machines on their namespace's own networks.
This is the first piece split out of #93 after its review, and it is smaller than what the review asked for: there is no controller. The admin writes the networks into a cluster-scoped
ProxmoxNetworkZone, the package chart renders it and one namespacedInClusterIPPoolper network, and thekubernetesandkubernetes-nodescharts read the zone withlookup. No Kube-OVN objects and no OVN writes. Routing between tenant VLANs stays with the operator's router, as on main today. #93 becomes the follow-up for VPC-backed subnets, with dynamic allocation and the drop between VPCs inside OVN.It sits on the provisioning layer already in main (cozystack/cozystack#4087, cozystack/cozystack#4483, cozystack/cozystack#4088, cozystack/cozystack#4089) and does not decide cozystack/cozystack#3481. The implementation will be a separate, small pull request in cozystack/cozystack; cozystack/cozystack#4813 stays a draft for reference.
Before review
decisions/directory, or says below why none is needed.Not a revision: this is a new proposal.
DCO
git commit --signoff).Assisted-by: LLM