Multi-VAN support by fgiorgetti · Pull Request #2564 · skupperproject/skupper

fgiorgetti · 2026-08-28T19:09:22Z

No new CRDs needed
Network ID can be set through site.spec.networkId
Router Access and Link now accept inter-network role
Router Access and Link now accept spec.routingKeys (inter-network role)
Dynamic port allocation for Router Access (only supported with updated CRD)
CRDs have been updated, but all updates are optional if not using multi-van
Unit and integration tests added

Summary by CodeRabbit

New Features
- Added multi-network (inter-VAN) connectivity using site network identifiers.
- Added routing key configuration for links and router access connections.
- Added automatic router access port allocation and status reporting.
- Added automatic creation and reconciliation of inter-network router connections.
- Added router network and auto-link configuration synchronization.
Bug Fixes
- Limited generated links and access permissions to supported router endpoints.
- Improved cleanup of obsolete connections and associated routing configuration.
- Improved handling of router access port conflicts and mixed port assignments.

* No new CRDs needed * Network ID can be set through site.spec.networkId * Router Access and Link now accept inter-network role * Router Access and Link now accept spec.routingKeys (inter-network role) * Dynamic port allocation for Router Access (only supported with updated CRD) * CRDs have been updated, but all updates are optional if not using multi-van * Unit and integration tests added

coderabbitai · 2026-08-28T19:09:40Z

📝 Walkthrough

Walkthrough

The change adds multi-VAN fields and routing-key support, dynamic router-access port allocation, CRD capability detection, router network and auto-link synchronization, inter-VAN reconciliation, endpoint filtering, and integration coverage.

Changes

Multi-VAN routing and router access

Layer / File(s)	Summary
Resource contracts and port allocation `pkg/apis/skupper/v2alpha1/`, `config/crd/bases/`, `internal/ports/`, `internal/cmd/skupper/debug/sweeper/`	Adds `networkId`, `routingKeys`, router-access role status, inter-network detection, and separate router-access port ranges.
CRD capability detection and controller wiring `internal/kube/client/*`, `internal/kube/controller/controller.go`, `internal/kube/watchers/watchers.go`, `config/rbac/cluster/clusterrole.yaml`	Adds CRD clients and schema-path checks. The controller enables dynamic ports when `status.roles` is available.
Router network and auto-link synchronization `internal/qdr/*`, `internal/kube/adaptor/config_sync.go`	Adds network and auto-link models, AMQP management operations, configuration diffs, and synchronization steps.
Site, link, and router-access reconciliation `internal/kube/site/`, `internal/site/`, `internal/kube/grants/tokens.go`, `internal/cmd/skupper/link/kube/link_generate.go`, `internal/fixtures/skupper_resources.go`	Propagates network IDs, allocates router-access ports, assigns inter-network roles, filters link endpoints, and reconciles topology and routing-key auto-links.
Integration flow validation `tests/integration/kube/controller/`, `internal/qdr/_test.go`, `internal/site/_test.go`, `internal/kube/site/site_test.go`, `pkg/apis/skupper/v2alpha1/_test.go`	Adds unit and integration coverage for roles, ports, auto-links, network removal, CRD checks, and envtest configuration polling.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟠 High · up to 76cde

This change adds multi-network routing and dynamic port allocation, but current behavior can reject valid allocated ports, halt later router configuration synchronization, and leave failed status updates unreported. These issues can disrupt configuration and resource visibility, so the PR is not merge-ready until they are addressed or explicitly accepted by the owners.

Suggested reviewers: nluaces, pwright, aryanp123

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.41% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 78 functions across 29 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding Multi-VAN support. It is directly related to the pull request objectives and changes.

Full details: Docstring Coverage

Explanation

Docstring coverage is 6.41% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 78 functions across 29 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 5

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a5e06ede-299f-4f21-89a9-0b358c270f1f

📥 Commits

Reviewing files that changed from the base of the PR and between 06223ca and f287422.

📒 Files selected for processing (32)

config/crd/bases/skupper_link_crd.yaml
config/crd/bases/skupper_router_access_crd.yaml
config/crd/bases/skupper_site_crd.yaml
config/rbac/cluster/clusterrole.yaml
internal/cmd/skupper/debug/sweeper/ports_test.go
internal/cmd/skupper/link/kube/link_generate.go
internal/fixtures/skupper_resources.go
internal/kube/adaptor/config_sync.go
internal/kube/client/client.go
internal/kube/client/crds.go
internal/kube/client/crds_test.go
internal/kube/client/fake/fake_client.go
internal/kube/controller/controller.go
internal/kube/grants/tokens.go
internal/kube/site/site.go
internal/kube/site/site_test.go
internal/kube/watchers/watchers.go
internal/ports/ports.go
internal/ports/ports_test.go
internal/qdr/amqp_mgmt.go
internal/qdr/qdr.go
internal/qdr/qdr_test.go
internal/qdr/sync_router_ops.go
internal/site/link.go
internal/site/link_test.go
internal/site/routeraccess.go
internal/site/routeraccess_test.go
pkg/apis/skupper/v2alpha1/link_types_test.go
pkg/apis/skupper/v2alpha1/types.go
pkg/apis/skupper/v2alpha1/zz_generated.deepcopy.go
tests/integration/kube/controller/site_test.go
tests/integration/kube/controller/suite_test.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

coderabbitai · 2026-08-28T19:16:54Z

+	MAX_PORT = 65435
+	// Ports reserved for dynamic allocation to router accesses
+	MIN_ROUTER_PORT = 65436
+	MAX_ROUTER_PORT = 65535
 )

 func NewFreePorts() *FreePorts {
+	return newFreePortsForRange(MIN_PORT, MAX_PORT)
+}
+
+func NewFreePortsForRouterAccess() *FreePorts {
+	return newFreePortsForRange(MIN_ROUTER_PORT, MAX_ROUTER_PORT)
+}


🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Keep the TCP port maximum separate from the general allocation maximum.

At Line 19, MAX_PORT becomes 65435. NewFreePortsForRouterAccess allocates ports through 65535, but the debug sweeper uses MAX_PORT to validate user input. The sweeper now rejects valid router-access ports from 65436 through 65535.

Keep MAX_PORT at 65535, and add a separate constant for the general allocation upper bound.

I will define a separate constant used by the debug sweeper.

@fgiorgetti, that approach addresses the validation issue.

Keep the general allocation maximum at 65435. Use the separate TCP port maximum constant in the debug sweeper so it accepts ports through 65535.

_{You are interacting with an AI system.}

c-kruse

Curious if you've got a plan for status for multi-van Links. IIUC these would stay Pending right now.

fgiorgetti · 2026-08-31T21:03:00Z

Curious if you've got a plan for status for multi-van Links. IIUC these would stay Pending right now.

@c-kruse not yet. I believe it is better to handle it separately.
Do you remember we discussed about collecting network info from $management instead of deriving from flow events? I was thinking we could incorporate things like that as part of the new mechanism. WDYT?

* RouterAccess description improved * Debug Sweeper now uses its own constant * Validate port collisions during RouterAccess reconciliation

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 82420edb-7eef-457a-a19b-a9cdbbafdb62

📥 Commits

Reviewing files that changed from the base of the PR and between f287422 and 76cde3a.

📒 Files selected for processing (7)

config/crd/bases/skupper_router_access_crd.yaml
internal/cmd/skupper/debug/sweeper/ports.go
internal/kube/site/site.go
internal/site/link.go
internal/site/routeraccess.go
internal/site/routeraccess_test.go
pkg/apis/skupper/v2alpha1/types.go

🚧 Files skipped from review as they are similar to previous changes (2)

internal/site/link.go
config/crd/bases/skupper_router_access_crd.yaml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

coderabbitai · 2026-08-31T21:49:32Z

+				)
+			}
+			la.SetConfigured(err)
+			s.updateRouterAccessStatus(la)


🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Propagate the RouterAccess status update error.

If UpdateStatus fails, this path removes the access from active configuration but returns success. The resource can remain without its error status, and the controller does not retry this reconciliation.

Proposed fix

- s.updateRouterAccessStatus(la) + if err := s.updateRouterAccessStatus(la); err != nil { + return err + }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

s.updateRouterAccessStatus(la)

if err := s.updateRouterAccessStatus(la); err != nil {

return err

}

🧰 Tools

🪛 golangci-lint (2.12.2)

[error] 1805-1805: Error return value of s.updateRouterAccessStatus is not checked

(errcheck)

Source: Linters/SAST tools

fgiorgetti requested review from c-kruse, nluaces and pwright as code owners August 28, 2026 19:09

coderabbitai Bot reviewed Aug 28, 2026

View reviewed changes

c-kruse reviewed Aug 31, 2026

View reviewed changes

Feedback from CodeRabbit

76cde3a

* RouterAccess description improved * Debug Sweeper now uses its own constant * Validate port collisions during RouterAccess reconciliation

coderabbitai Bot reviewed Aug 31, 2026

View reviewed changes

Navigation Menu

Uh oh!

Multi-VAN support - #2564

Multi-VAN support#2564
fgiorgetti wants to merge 2 commits into
skupperproject:mainfrom
fgiorgetti:multi-van-slim

fgiorgetti commented Aug 28, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 28, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot Aug 28, 2026 •

edited

Loading

Uh oh!

fgiorgetti Aug 28, 2026

Uh oh!

coderabbitai Bot Aug 28, 2026

Uh oh!

Uh oh!

Uh oh!

c-kruse left a comment

Uh oh!

fgiorgetti commented Aug 31, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-			s.updateRouterAccessStatus(la)
+			if err := s.updateRouterAccessStatus(la); err != nil {
+				return err
+			}

Uh oh!

Conversation

fgiorgetti commented Aug 28, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fgiorgetti Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

c-kruse left a comment

Choose a reason for hiding this comment

Uh oh!

fgiorgetti commented Aug 31, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fgiorgetti commented Aug 28, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 28, 2026 •

edited

Loading

coderabbitai Bot Aug 28, 2026 •

edited

Loading