Adoption mode: guards, and a filter unit that never flushes the ruleset (hq ADR 0100, 0103) #38

2026-09-22T17:28:25Z

jschoubben commented

2026-09-22 17:28:25 +00:00

Merge after mesh-controller. Its strict manifest parser must know guards first.

postgres and lavinmq declare guards: the store's port and the broker's management port.
nftables now loads the filter through its own mesh-filter.service, whose stop deletes only table inet mesh. The stock unit's stop runs nft flush ruleset, which wipes the container runtime's rules and any other firewall's rules on every filter change. The resource id load is kept, so existing nodes never stop the old unit, and nothing is flushed on the way over.
The stock unit keeps a drop-in. On nodes where nftables.service is still enabled, it gets a drop-in whose ExecStop deletes only the mesh's table.

The manifests are validated by mesh-controller's catalogue tests (foundation_manifests_test.go).

**Merge after mesh-controller.** Its strict manifest parser must know `guards` first. - **postgres** and **lavinmq** declare `guards`: the store's port and the broker's management port. - **nftables** now loads the filter through its own `mesh-filter.service`, whose stop deletes only `table inet mesh`. The stock unit's stop runs `nft flush ruleset`, which wipes the container runtime's rules and any other firewall's rules on every filter change. The resource id `load` is kept, so existing nodes never stop the old unit, and nothing is flushed on the way over. - **The stock unit keeps a drop-in.** On nodes where `nftables.service` is still enabled, it gets a drop-in whose `ExecStop` deletes only the mesh's table. The manifests are validated by mesh-controller's catalogue tests (`foundation_manifests_test.go`).

jschoubben added 2 commits 2026-09-22 17:28:26 +00:00

Guard the store and management ports on adopted nodes, and load the filter through a unit that never flushes the ruleset (hq ADR 0100) 0c37d7389d

Make the stock nftables unit's stop delete only the mesh's table on nodes that still have it enabled (hq ADR 0100) 84012fab2e

jschoubben added 1 commit 2026-09-22 18:07:18 +00:00

Reload the filter on a rule change rather than restart it, so the node is never unfiltered in between (hq ADR 0102) 90104d0818

jschoubben merged commit 6e88982498 into main

2026-09-22 19:01:56 +00:00

jschoubben deleted branch feat/adoption-mode

2026-09-22 19:01:56 +00:00

Sign in to join this conversation.