Mattia Eleuteri 3c657a4cc1 feat(vpc): expose allowSubnets per subnet ...

Every VPC subnet is rendered private, so kube-ovn drops any packet
whose source lies outside the subnet's own CIDR. A tenant that runs a
VPN or router VM on a subnet and points a static route at it gets the
forward path from the existing routes value, but traffic arriving
from the remote network is then dropped by the private ACL.

Subnet is cluster-scoped, so the only workaround so far has been an
operator patching spec.allowSubnets by hand: something the tenant cannot
do, that no application value records, and that is lost whenever the
subnet is recreated. Declaring it per subnet keeps the widening in the
tenant's own VPC and scoped to the one subnet that needs it.

Assisted-by: LLM
Signed-off-by: Mattia Eleuteri <mattia@hidora.io>

2026-09-29 18:47:18 +03:00

..

types.go

feat(vpc): expose allowSubnets per subnet

2026-09-29 18:47:18 +03:00

zz_generated.deepcopy.go

feat(vpc): expose allowSubnets per subnet

2026-09-29 18:47:18 +03:00