mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 00:27:04 +09:00
Mattia Eleuteri
3c657a4cc1
Every VPC subnet is rendered private, so kube-ovn drops any packet whose source lies outside the subnet's own CIDR. A tenant that runs a VPN or router VM on a subnet and points a static route at it gets the forward path from the existing routes value, but traffic arriving from the remote network is then dropped by the private ACL. Subnet is cluster-scoped, so the only workaround so far has been an operator patching spec.allowSubnets by hand: something the tenant cannot do, that no application value records, and that is lost whenever the subnet is recreated. Declaring it per subnet keeps the widening in the tenant's own VPC and scoped to the one subnet that needs it. Assisted-by: LLM Signed-off-by: Mattia Eleuteri <mattia@hidora.io>
42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
##
|
|
## @section Common parameters
|
|
##
|
|
|
|
## @typedef {struct} Subnet - Subnet of a VPC
|
|
## @field {string} name - Subnet name
|
|
## @field {string} [cidr] - IP address range
|
|
## @field {[]string} [allowSubnets] - Additional source CIDRs admitted into this private subnet, such as remote networks routed in through a gateway VM
|
|
|
|
## @param {[]Subnet} subnets - Subnets of a VPC
|
|
subnets: []
|
|
## Example:
|
|
## subnets:
|
|
## - name: mysubnet0
|
|
## cidr: "172.16.0.0/24"
|
|
## - name: mysubnet1
|
|
## cidr: "172.16.1.0/24"
|
|
## allowSubnets:
|
|
## - "192.168.1.0/24"
|
|
|
|
## @typedef {struct} Peer - VPC peering target
|
|
## @field {string} vpcName - Logical name of the remote VPC (without "virtualprivatecloud-" prefix)
|
|
## @field {string} tenantNamespace - Namespace of the remote tenant
|
|
|
|
## @param {[]Peer} peers - VPC peering connections (bidirectional declaration required)
|
|
peers: []
|
|
## Example:
|
|
## peers:
|
|
## - vpcName: "other-vpc"
|
|
## tenantNamespace: "tenant-other"
|
|
|
|
## @typedef {struct} Route - Static route entry
|
|
## @field {string} cidr - Destination CIDR
|
|
## @field {string} nextHopIP - Next hop IP address
|
|
|
|
## @param {[]Route} routes - Static routes for the VPC
|
|
routes: []
|
|
## Example:
|
|
## routes:
|
|
## - cidr: "172.16.1.0/24"
|
|
## nextHopIP: "10.0.0.1"
|