feat(gateway): Add config/gateway/ Kustomize manifests - #354
Merged
Conversation
privateip
force-pushed
the
feat/edge-gateway-05-images-ci
branch
from
August 12, 2026 18:26
76455c5 to
15a4155
Compare
privateip
force-pushed
the
feat/edge-gateway-06-config-manifests
branch
from
August 12, 2026 18:26
a9b4c65 to
bb4683a
Compare
privateip
force-pushed
the
feat/edge-gateway-05-images-ci
branch
from
August 12, 2026 19:04
15a4155 to
6d85070
Compare
privateip
force-pushed
the
feat/edge-gateway-06-config-manifests
branch
from
August 12, 2026 19:04
bb4683a to
3688b27
Compare
privateip
force-pushed
the
feat/edge-gateway-05-images-ci
branch
from
August 12, 2026 19:18
6d85070 to
4344c1a
Compare
privateip
force-pushed
the
feat/edge-gateway-06-config-manifests
branch
from
August 12, 2026 19:18
3688b27 to
c07772d
Compare
privateip
force-pushed
the
feat/edge-gateway-05-images-ci
branch
from
August 12, 2026 19:26
4344c1a to
469c9d0
Compare
privateip
force-pushed
the
feat/edge-gateway-06-config-manifests
branch
from
August 12, 2026 19:26
c07772d to
b1e1344
Compare
privateip
force-pushed
the
feat/edge-gateway-05-images-ci
branch
from
August 12, 2026 19:44
469c9d0 to
53414db
Compare
privateip
force-pushed
the
feat/edge-gateway-06-config-manifests
branch
from
August 12, 2026 19:44
b1e1344 to
6797be1
Compare
2 tasks
ecv
previously approved these changes
Aug 12, 2026
ecv
left a comment
ecv
left a comment
Contributor
There was a problem hiding this comment.
Approving. Nothing found here, and I went looking specifically at the security surface since this is the manifest that grants a pod the right to attach an XDP program.
The capability set is scoped rather than blanket: NET_ADMIN, BPF and PERFMON on the gateway container, NET_ADMIN alone on the co-located router, allowPrivilegeEscalation: false on both, and no privileged: true anywhere. That is the right shape.
RBAC matches what the reconcilers actually do, including omitting create and delete on the resources the external operator owns. The bpf-fs volume being Directory rather than DirectoryOrCreate is the correct call for a host mount that must already exist.
Keeping this out of the root kustomization is right too, for the same reason config/fabric is: the DaemonSet needs a per-node overlay before it means anything, and a generic default would deploy something broken.
CI red here is inherited from #351's module replace, tracked in #358.
This was referenced Aug 12, 2026
privateip
force-pushed
the
feat/edge-gateway-05-images-ci
branch
from
August 12, 2026 21:30
53414db to
a635a3a
Compare
- config/gateway/serviceaccount.yaml, rbac.yaml: the gateway control
plane's own ServiceAccount/ClusterRole, split out of
config/router/rbac.yaml's single ClusterRole (which used to grant
one galactic-router identity both the BGP-family CRD verbs and
networkgateways/networkrules verbs because both reconciler sets
lived in the same binary -- they no longer do).
- config/gateway/kustomization.yaml: applies serviceaccount+rbac only
(safe/idempotent cluster-wide); deliberately does not include base/,
same exemption as config/fabric/ -- GALACTIC_GATEWAY_SRV6_ADDRESS has
no generic default and must be pinned per gateway node by a further
overlay (see deploy/containerlab/resources/galactic-router-gateway/
for a worked example).
- config/gateway/base/{daemonset.yaml,kustomization.yaml}: the
two-container (galactic-router + galactic-gateway) DaemonSet spec,
gateway-role node affinity, not applied directly.
- config/router/rbac.yaml: trims create/update/patch on
bgpadvertisements/bgpvrfinstances -- those verbs were only ever
needed by NetworkGatewayReconciler/NetworkRuleReconciler, which no
longer live in this binary.
- config/fabric/daemonset.yaml: adds the gateway role's node-affinity
value and NoSchedule toleration, so fabric-router (and therefore the
underlay eBGP session the gateway's XDP datapath depends on) also
runs on gateway-labeled nodes.
- .github/workflows/publish.yaml: now that config/gateway/base exists,
stamp it with both galactic-router's and galactic-gateway's published
tags (that DaemonSet has two containers) -- the previous branch added
the publish-galactic-gateway-image job itself but couldn't reference
this path yet, since it didn't exist until this commit.
- AGENTS.md: describes config/gateway/ in place of the old
config/router/gateway/ design.
Sixth branch in the edge-gateway stack; builds on
feat/edge-gateway-05-images-ci.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
privateip
force-pushed
the
feat/edge-gateway-06-config-manifests
branch
from
August 13, 2026 01:13
6797be1 to
6f42dd0
Compare
4 tasks
ecv
approved these changes
Aug 13, 2026
scotwells
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The image published in the previous PR needs Kubernetes manifests to actually run it. This adds the gateway control plane's own ServiceAccount, ClusterRole, and two-container DaemonSet base, split out of galactic-router's manifests now that the reconcilers they cover no longer live in that binary. galactic-router's RBAC is trimmed to match, and the fabric underlay DaemonSet's affinity is extended to gateway-role nodes. Sixth branch in the edge-gateway stack; builds on the images and CI PR.
Test plan
kubectl kustomizebuilds cleanly for the new and changed manifeststask lintis cleanRelated to #17