Store device FIB for observability (no rule limiting) #5
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unkin/tomswallapi#5
Reference in New Issue
Block a user
Delete Branch "benvin/device-fib"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Why
The agent reports each device's FIB (tomswall #3, merged). The control plane stores it for fleet visibility and future zone-origin validation. It deliberately does NOT limit which rules a device enforces — with default routes everywhere that could not narrow anything, and the interface-agnostic rule form is correct under ECMP precisely because it is path-independent (over-approximation is safe and intended).
Changes
reachable_prefixes+routes_reported_atto devices (migration 0004, verified against Postgres 17); expose reachable_prefixes on the device resource.POST /api/v1/devices/{name}/routesendpoint and store.UpdateDeviceRoutes. This is scoping/observability data, so it does not bump the config generation.Devices carry a reachable_prefixes set (migration 0004) reported by their agent from the kernel FIB, via a new agent-authed POST /devices/{name}/routes endpoint. This is scoping/observability data, so it does not bump the config generation and is exposed on the device resource. It deliberately does NOT limit which rules a device enforces: the compiler still emits every applicable rule on every enforcing device. The interface-agnostic, address-matched rule form is correct under ECMP precisely because it does not depend on which device is on the path, and most routers hold a default route anyway — so reachability could not meaningfully narrow the rule set. The reported FIB is kept for fleet visibility and future zone-origin validation.