oxidecomputer / oxidecomputer/omicron
`targets` in `ResolvedVpcFirewallRule` should not scale linearly with the number of instances in a VPC
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 572
- Forks
- 97
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 96
Description
(Breaking out of https://github.com/oxidecomputer/customer-support/issues/448)
The vpc:default target in many of our rules is expanded out to the set of all NICs in the VPC, which is then repeated per-rule. A target today must be a NetworkInterface.
At the very least, we should be pruning the set of targets to the NICs we actually expect will be present on the target sled. I think we can go further and have similar expressions to filters (e.g., a target can be a VNI, or just the ID of a NIC), although I appreciate there is something useful in having nexus always specify the exact set of NICs who should install a rule.
We could also pull targets up a level in the struct (s.t. we send a set of rules for each common set of targets), but I'm less keen on that.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by locating ResolvedVpcFirewallRule and the code that expands vpc:default into NIC targets, then compare the proposed pruning, expression-based targets, and shared-target alternatives. Done requires an agreed target model that avoids scaling with every NIC in the VPC.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100