benvin
9dbeb62414
Devices carry a reachable_prefixes set (migration 0004) reported by their agent
from the kernel FIB, via a new agent-authed POST /devices/{name}/routes endpoint.
This is scoping/observability data, so it does not bump the config generation and
is exposed on the device resource.
It deliberately does NOT limit which rules a device enforces: the compiler still
emits every applicable rule on every enforcing device. The interface-agnostic,
address-matched rule form is correct under ECMP precisely because it does not
depend on which device is on the path, and most routers hold a default route
anyway — so reachability could not meaningfully narrow the rule set. The reported
FIB is kept for fleet visibility and future zone-origin validation.
8 lines
462 B
SQL
8 lines
462 B
SQL
-- Per-device reachability, reported by the agent from its FIB. The compiler uses
|
|
-- it to scope which routers actually need to enforce an intent: a router only
|
|
-- carries a rule if it can route to both the source and destination networks.
|
|
-- When absent, the compiler safely over-approximates (enforces everywhere).
|
|
ALTER TABLE devices
|
|
ADD COLUMN reachable_prefixes JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
ADD COLUMN routes_reported_at TIMESTAMPTZ;
|