Repository navigation

feat: add an L4 LoadBalancer mode for non-VM services - #25

Draft

mattia-eleuteri wants to merge 42 commits into

cozystack:mainfrom

mattia-eleuteri:feat/l4-loadbalancer

Draft

feat: add an L4 LoadBalancer mode for non-VM services#25
mattia-eleuteri wants to merge 42 commits into
cozystack:mainfrom
mattia-eleuteri:feat/l4-loadbalancer

Commits on Aug 7, 2026
- proxy: scope datapath rules to the node hosting the backend
  mattia-eleuteri
  committed
  049ee94
- proxy: do not abort the pod when startup cleanup hits ENOENT
  mattia-eleuteri
  committed
  8aee75f
Commits on Sep 15, 2026
- proxy: keep the egress SNAT map cluster-wide
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  1605704
- proxy: retry cleanup deletions per element on ENOENT
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  1110b24
- proxy: serialize datapath writes and isolate conflict removals
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  0cdd984
- proxy: retry failed datapath writes, commit additions strictly
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  76f2548
- controllers: serialize whole reconciliations against the retry loop
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  2eafd9a
- controllers: retry failed datapath withdrawals
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  0b10c26
- controllers: build the startup snapshot from the informer stores
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  c78640c
- controllers: requeue the startup cleanup when its retry fails
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  494dbf7
Commits on Oct 1, 2026
- chart: inject NODE_NAME into the DaemonSet
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  9f5a546
Commits on Oct 2, 2026
- docs: propose an L4 LoadBalancer mode
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  4b264c4
- l4: select the services the L4 mode takes over
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  6cdb2bf
- l4: compute what a node programs for the L4 mode
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  7377375
- l4: decide which conntrack entries a sync leaves stale
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  0c3b666
- proxy: program the L4 mode's table with nftables
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  e8a6e7b
- proxy: purge conntrack entries over netlink
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  cb5bc01
- proxy: send real traffic through the L4 table in tests
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  98c6c95
- controllers: reconcile the L4 mode from the informer caches
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  a7237b6
- main: run the L4 mode behind --enable-l4-loadbalancer
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  6576eab
- chart: add an l4LoadBalancer.enabled switch
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  ccc5db0
- proxy: check that rebuilding the L4 table keeps connections alive
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  49ce097
- proxy: check the Close errors in the L4 tests
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  d32b1c6
- docs: document the L4 mode and align the RFC with the prototype
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  c2f7158
- l4: report each notice once
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  b52e84f
- main: allow running the L4 mode without the VM mode
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  bed97a7
- l4: let not-ready and terminating backends drain
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  fd5b853
- controllers: keep a forced L4 pass forced until it succeeds
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  dedc066
- proxy: give the L4 sets IDs of their own transaction
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  1ee6f3d
- l4: drain only terminating backends, purge not-ready ones
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  a83bd5b
- docs: reconcile the L4 mode with the Kyverno guard on CCM Services
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  181b41c
- proxy: rename the L4 dnat chain so nft can name it
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  b003f67
- controllers: log the L4 mode under its own name
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  dc0eef2
- docs: record the lab run of the L4 mode
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  3d69216
- l4: purge TCP flows with their frontend only, as kube-proxy does
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  c1a0642
- docs: correct what the Kyverno guard refuses on CCM Services
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  fbeca1a
- proxy: draw the masqueraded source port fully at random
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  d9e2abd
- docs: record the source-port reuse seen under load and its fix
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  48b19e7
Commits on Oct 5, 2026
- main: leave the L4 table alone when told another instance owns it
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  c383385
- docs: align the RFC's L4 ruleset with what nft lists
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  785522e
- docs: fix the README sentence on the announcing node
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  eebf7b8
Commits on Oct 6, 2026
- docs(rfc): describe the CCM admission guard without an internal reference
  
  mattia-eleuteri
  and
  Claude (claude)
  committed
  6129160

Commits

Commits on Aug 7, 2026

Commits on Sep 15, 2026

Commits on Oct 1, 2026

Commits on Oct 2, 2026

Commits on Oct 5, 2026

Commits on Oct 6, 2026