Restore green CI on main after the NAT datapath rename - #540
Merged
Merged
Conversation
The NAT capability test landed in the pre-rename nat66prog package after the NAT datapath moved to natprog, leaving a test-only package that no longer compiles and failing lint, build, and unit tests on main. It now targets the natprog package, the galactic-nat manifest, and its galactic-nat container. The uSID capability test read galactic-cni's capabilities from the manifest, which now grants PERFMON, so it stopped guarding against the variable packet pointer offsets it was written to catch. It now also loads with the manifest's capabilities minus PERFMON. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ecv
approved these changes
Sep 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every contributor's CI on
mainis failing Lint, Build, and Unit Tests. This change restores it, and restores a guard that keeps the uSID datapath loadable on nodes without elevated verifier privileges.#536 added capability-restricted load tests while #525 renamed the NAT datapath. The two merged cleanly but were never tested together, so the NAT test landed in a package that no longer exists. It now targets the renamed datapath and its deployment. The running datapath was never affected.
#537 granted PERFMON to galactic-cni. The uSID capability test reads its capabilities from that deployment, so it silently stopped checking that the datapath loads without PERFMON, which is the regression #536 was written to catch. The test now also loads without PERFMON, so reintroducing that dependency fails CI whatever the deployment grants.
The uSID datapath no longer needs PERFMON to load. This change leaves the grant in place so the maintainers can decide whether to keep it.
🤖 Generated with Claude Code