Network Addressing Register — authoritative source of every VLAN & subnet¶
Read in your language: English · Português · Español
This is the single source of truth for network addressing. Where any other document (ARCHITECTURE, README, an ADR, a manifest comment) disagrees with this register, this register wins and the other document is stale. It was created (audit-v6 DOCS-ARCH) to end the three-way disagreement about the management plane (
100.127.252.0/24VXLAN vs100.127.252.0/22VLAN 2777 vs10.254.254.0/24VLAN 99). Last verified against the manifests at v4.0.0.
1. Plane summary¶
| Plane | Purpose | Bearer | Subnet(s) | NetworkPolicy applies? |
|---|---|---|---|---|
| eth0 (OOBI/control) | K8s flannel, dashboard, Prometheus scrape, control | node NIC | cluster CIDR | yes |
| Data plane (net1) | Agent → NGFW → persona traffic under test | Multus macvlan | see VLAN table | no (macvlan bypasses NetworkPolicy by design) |
| SNMP / DUT-management | SNMP polling of the NGFW + Nexus mgmt interfaces | VLAN 99 | 10.254.254.0/24 |
yes (eth0-side) |
| OOBI fabric | Out-Of-Band Infrastructure orchestration between MÓDULOs | VLAN 2777 | 100.127.252.0/24 + IPv6 ULA |
yes |
2. VLAN register¶
| VLAN | Role | Subnet (IPv4) | IPv6 | Gateway | Notes |
|---|---|---|---|---|---|
| 20 | Playwright agents (data) | 172.16.0.0/16 |
— | NGFW | Browser-real load leg |
| 30 | k6 agents (data) | 172.17.0.0/16 |
— | NGFW | Volume load leg |
| 40 | Cloner ISP egress | DHCP from upstream router | — | upstream ISP router | Only path to the public Internet (k8s/80-cloner-nad.yaml) |
| 99 | SNMP / DUT-management | 10.254.254.0/24 |
— | 10.254.254.1 |
.2 Nexus MGMT0 · .3 NGFW mgmt · .10–.49 SNMP infra · .50–.82 MÓDULO orchestration |
| 101–120 | Personas — one VLAN per country | public /24 per country (see below) |
dual-stack per ADR 0058 | VyOS-ISP (.1 per country LAN) |
5 personas per VLAN × 20 = 100 (61 baked-in + 39 cloned) |
| 1982 | OSPF peer module (DUT-facing) | 200.130.0.8/30 |
2001:db8:0:1982::/126 |
— | k8s/dut/42-vlan1982-ospf-peer-nad.yaml |
| 2001 | NGFW outside link (edge) | 200.130.0.0/30 |
— | — | NGFW-outside .1 ↔ VyOS-inside .2; the single persona-side NGFW interface in v4.3 (edge_link in platform/network/public-ip-pool.yaml) |
| 2777 | OOBI fabric (control) | 100.127.252.0/24 |
fd5a:7c5e:a72::/64 (ULA) |
fabric | Plain 802.1Q — no VXLAN (ADR 0043 superseded the VXLAN model of ADR 0019) |
| 2809 | BGP peer module (DUT-facing) | 200.130.0.12/30 |
2001:db8:0:2809::/126 |
— | Synthetic full-table eBGP feed to the NGFW (k8s/dut/41-vlan2809-bgp-peer-nad.yaml); never originates pool prefixes |
2.1 Superseded addressing (do NOT use)¶
- ❌ VXLAN VNI
254254over UDP/4789 — the OOBI overlay was removed by ADR 0043. The OOBI fabric is now a plain 802.1Q VLAN (2777). Any doc still describing VXLAN for OOBI is stale. - ❌
100.127.252.0/24on "VLAN 99" — VLAN 99 is now SNMP/DUT-management (10.254.254.0/24). The OOBI100.127.252.0/24subnet moved to VLAN 2777. - ❌ RFC1918 persona subnets
10.1.x.0/27/10.2.x.0/27(VLANs 200–209) — the v4.2 model. Replaced by public/24per country (ADR 0007 / schema v4.3). Never use RFC1918 for personas.
3. Persona public-IP pool (VLANs 101–120)¶
Personas carry real public /24s, one country per VLAN, allocated from
platform/network/public-ip-pool.yaml
and pre-flight-validated by tools/validate-ip-pool.sh
(BGP no-announce invariant + WHOIS/GeoIP/DNSBL). Examples:
| Country | VLAN | Prefix (example) |
|---|---|---|
| US | 101 | 198.32.10.0/24 |
| CN | 102 | 202.112.10.0/24 |
| NG | … | 196.32.0.0/24 |
| … (20 countries total) | 101–120 | see public-ip-pool.yaml |
The BGP gateway module (VyOS + FRR) is the persona default gateway; it holds a no-announce invariant so the borrowed public space is never advertised off-lab.
Per-country host allocation (as generated): .1 = VyOS-ISP gateway; persona
i (0-based, personas.yaml order within the country) owns the disjoint
IPAM block .{10+10i}–.{19+10i} of its country /24 — block 0 = .10–.19
(e.g. shop at 198.32.10.10), block 4 = .50–.59 (see any
personas/_generated/<name>/network-attachment.yaml). The block's first address
is the primary pod IP; the rest is replica headroom, and each persona's
certificate carries IP SANs for its own block only. Disjoint blocks are what
keep the per-persona host-local allocators collision-free — before the fix,
every persona NAD in a country shared a .2–.30 range with an independent
allocator, so two pods on the same country VLAN could receive the same IP.
.60–.254 is reserved for future growth (allocation_convention in
public-ip-pool.yaml).
4. How to keep this register correct¶
- When a manifest changes a subnet/VLAN, update the row here in the same PR.
- ADRs that change addressing (0007, 0043, 0058) must link back to this register.
- A doc-drift check should grep for the superseded values in §2.1 and fail if they reappear outside this file.