Proposals¶
Every design decision in aether is written down before it is built, and each record is published as it was written. The status is the proposal's own wording; the dot beside it is that wording sorted into five buckets, nothing more.
| # | Proposal | Status | Date |
|---|---|---|---|
| 035 | Vanity Go module path aethermesh.devvanity-import-path the aethermesh.dev website (the serving surface), proposal 010 (the sibling proxy workspace — C++, unaffected). |
Accepted — 2026-08-08 (apex aethermesh.dev, served by the docs site). The serving half (go-import meta + build guard) ships first; the module rename is the follow-up PR and is gated on the meta being live. |
2026-08-08 |
| 034 | UDS Support for Podspod-uds-support | Implemented (Phases 1 + 1b) and production-validated — annotation path (#616/#617) and EndpointPolicy CRD path (#618) shipped, kind e2e in CI (#619), and both paths validated under an 8-hour churn soak on talos-main (2026-08-03; follow-ups tracked in #628/#629). Phase 2 (outbound egress socket) remains deferred post-redirect-all. |
2026-06-11 |
| 033 | Node-taint lifecycle — re-arm the agent-not-ready taint across reboots and agent outagesnode-taint-lifecycle issue #263 #261 (the startup taint + one-shot removal), proposal 031 (agent flag-surface reduction — the "no new flags" philosophy this follows). | Implemented — the taint lifecycle shipped (agent/internal/node): the agent-not-ready taint re-arms across reboots and agent outages. (Accepted 2026-07-19.) Amended 2026-09-04 (#667) — the removal gate now requires CNI conflist chaining as well as the socket; see the Amendment section at the end. (No in-page anchor link here on purpose: the website republishes this Status line verbatim on /proposals/, where a #-relative link would resolve against the index and break the strict build.) |
2026-07-19 |
| 032 | Upgrade Gateway API to v1.6.1gateway-api-1.6 | Accepted (implemented 2026-07-18) | 2026-07-18 |
| 031 | Reduce the agent's feature-flag surfaceagent-flag-surface-reduction | Implemented — the assessed flag retirements landed (e.g. --l4-routes removed; L4 route types now gate only on their Gateway API CRDs being installed). (Assessment 2026-07-12.) |
2026-07-12 |
| 030 | Move the remaining data-plane ports out of Istio's reserved rangeport-range-migration | Implemented — the data-plane ports moved to 18008/18009/18021; nothing remains in Istio's reserved 15xxx range. | — |
| 029 | EdgeConfig — edge best-practices, per-instance, native Gateway APIedge-config proposal 018 (Gateway API edge), 015 (MeshConfig — the CRD + proto.Merge default override precedent), 028 (geoip — folds onto this config), the Envoy edge best-practices doc (envoyproxy.io docs ... best practices edge). | Implemented — EdgeConfig shipped: edge best-practices defaults, per-Gateway parametersRef overrides, and HTTP/3 (QUIC) support, with its admission webhook in the controller. (Accepted 2026-07-06.) |
2026-07-06 |
| 028 | GeoIP at the edgegeoip proposal 003 017 018 (the edge + Gateway API HTTPRoute — geo-routing consumers), #476 RBAC proposal 027 ext authz (geo-blocking consumers), proposal 027 (the preset-sidecar pattern the DB updater follows). | Implemented — edge GeoIP shipped: x-geo-* request enrichment with inbound spoof-strip and route-cache clearing. (Accepted 2026-07-06.) |
2026-07-06 |
| 027 | external authorization (ext_authz) via a node-proxy sidecarext-authz proposal 025 (proxy-extension escape hatch — the enablement machinery), proposal 015 (MeshConfig — the system-config half), proposal 026 (config propagation — policy parameters ride the channel), proposal 019 (waypoint — the alternative enforcement point, unbuilt). | Implemented — the node-local ext_authz sidecar (UDS transport, OPA preset) shipped; deployed enabled-but-inert on talos-main. (Accepted 2026-07-05.) | 2026-07-05 |
| 026 | Multi-cluster config propagationmulti-cluster-config-propagation proposal 006 (multi-region etcd federation — the registry bus), proposal 019 (multicluster node-waypoint — the producer-side enforcement option), proposal 018 (Gateway API GAMMA — the config that needs to propagate), proposal 023 (route-by-Service), proposal 015 (MeshConfig CRD), proposal 017 (VirtualHost CRD), proposal 025 (proxy-extension escape hatch — the surface that surfaced this gap), the MCS ServiceExport Import work. project multicluster registry, project registrar etcd vs ddb, project gateway api gamma. | Implemented — Option E (control cluster — centralized config authority) shipped on Option C's export/import channel: the registrar's leader-elected config-export controller writes ServiceConfigProjections to the shared registry, and the agent's --import-config materializer (with --control-cluster restricting trust to one origin; local config wins) imports them — validated by a two-kind-cluster e2e. Option D (producer-waypoint) for class-1 enforcement; Option A (GitOps) for class-2 consumer-local config; Option B rejected. Run the control cluster as a pure-management cluster (no mesh workloads). etcd key-ACL hardening is parked as a follow-up. (Accepted 2026-06-29.) |
2026-06-29 |
| 025 | Proxy-extension escape hatch for Gateway API / GAMMAproxy-extension-escape-hatch proposal 026 (multi-cluster config propagation — gates the Service-targetRef form), proposal 018 (Gateway API GAMMA), proposal 017 (VirtualHost CRD — the edge escape-hatch precedent), proposal 015 (MeshConfig CRD — the policy-attachment precedent), proposal 011 #396 (envoy --mode validate offline gate — the optional deeper CI gate), proposal 023 (route-by-Service). project mesh config crd, project gateway api gamma, project edge proxy plan. | Implemented — Option C (ExtensionRef → typed HTTPFilter CRD, opaque body, fail-closed in-process proto-validate — no Envoy binary in the webhook) shipped in full and is talos-validated: the route-rule ExtensionRef form, the Service-targetRef (policy-attachment) form (unblocked once proposal 026 landed), and CHAIN-scoped filters. common/extensionfilter is the single source of truth for the allow-list + validation/rendering. (Accepted 2026-06-29.) |
2026-06-29 |
| 024 | Gateway API conformance in CIconformance-ci proposal 018 (Gateway API GAMMA — the API this certifies), proposal 022 (arbitrary-service interception — the blocker for MESH-HTTP), proposal 003 (edge proxy — the north-south data plane GATEWAY-HTTP exercises); docs conformance gateway-api-features.md, docs conformance baseline-.md, test e2e (the existing kind harness this reuses); project gateway api gamma, project session state 20260626. | Implemented — Gateway API conformance runs in CI and is a hard gate (GATEWAY-HTTP + MESH-HTTP Core). (2026-06-28 design.) | 2026-06-28 |
| 023 | Service-based routing — decoupling the GAMMA route target from ServiceAccount identityservice-based-routing proposal 018 (Gateway API GAMMA), proposal 020 (namespace-aware services — the ns svc registry key + SA-identity model this refines), proposal 022 (arbitrary-Service interception — captures the real Service ClusterIP:port this builds the routing layer on top of), proposal 004 (demand-scoped distribution); the MESH-HTTP conformance investigation (2026-06-28); project m3 mesh http conformance, project gateway api gamma, project 020 m1 progress, project m2a gate result. | Implemented — the route-target catalog + real-ClusterIP:port capture shipped (GAMMA-on-capture); the versioned-backend shape it exists for is exercised by the MESH-HTTP conformance profile, which is green and a hard CI gate (proposal 024). (2026-06-28 design.) |
2026-06-28 |
| 022 | Arbitrary-Service interception (the genuine GAMMA / Mesh data plane)arbitrary-service-interception proposal 018 (Gateway API GAMMA — the Phase 3 "interception model" this details), proposal 020 (namespace-aware services + the mesh-Service model this builds on), proposal 004 (demand-scoped distribution — the scope-limiter), proposal 005 (multi-port); the conformance rev2 + the MESH root-cause investigation (2026-06-25); project gateway api gamma, project capture odcds stuck 404, project demand scoped. | Implemented — arbitrary-service interception (redirect-all) shipped and is the default for managed pods (agent.captureRedirectAllDefault=true), soak-validated hitless on talos. (2026-06-25 design.) |
2026-06-25 |
| 021 | Per-Gateway addressing for the edgeper-gateway-addressing proposal 018 (Gateway API GAMMA — north-south edge), proposal 003 (edge proxy); the conformance baseline (docs conformance baseline-2026-06-25.md) that surfaced this, and #323 (namespace-agnostic edge) which exposed it; project edge proxy plan, project gateway api gamma. | Implemented — per-Gateway addressing (Phase 2) shipped and is the default (edge.perGatewayAddressing=true). (2026-06-25 design.) |
2026-06-25 |
| 020 | Namespace-aware services + opt-in non-mesh endpoint projectionnamespace-aware-services-and-endpoint-projection proposal 006 (origin-partitioned registry key schema — the migration pattern this follows), proposal 018 (Gateway API GAMMA + MCS — the alignment driver), proposal 019 (multi-cluster waypoint — bounds cross-cluster non-mesh reachability), proposal 004 (demand-scoped distribution), proposal 005 (multi-port); project multicluster registry, project gateway api gamma, project demand scoped. | Implemented — the namespace-aware <ns>/<serviceAccount> registry-key cutover completed and is the mesh's identity model (registry keys, SVIDs, generated mesh Services). (2026-06-25 design.) |
2026-06-25 |
| 019 | Multi-cluster pod-to-pod via a per-node waypoint (non-routable pod IPs)multicluster-node-waypoint proposal 018 (Gateway API GAMMA — the connectivity modes this refines), proposal 006 (origin-partitioned per-region registry — the cross-cluster plane), proposal 003 (edge proxy — the SNI-passthrough primitive this reuses), proposal 004 (demand-scoped distribution); project transport migration (the HBONE node tunnel this re-introduces, scoped to cross-cluster), project multicluster registry, project gateway api gamma. | Implemented — the node proxy acts as the per-node E/W gateway behind --east-west-waypoint (default off; needs shared etcd + shared SPIRE trust domain), e2e-validated. (2026-06-24 design.) |
2026-06-24 |
| 018 | Gateway API for aether — north-south + GAMMA east-westgateway-api-gamma proposal 017 (VirtualHost — the north-south CRD this subsumes), proposal 003 (edge proxy), proposal 004 (demand-scoped distribution), proposal 005 (multi-port), proposal 006 (origin-partitioned registry — the cross-cluster plane), proposal 015 (MeshConfig controller webhook); project edge proxy plan, project demand scoped, project registrar etcd vs ddb. | Implemented — all phases shipped and default-on: Phases 1–2 (edge HTTPRoute + GAMMA east-west), Phase 3a (HTTP transparent capture), and Phase 3b (L4 TCPRoute/TLSRoute/UDPRoute, default-on since #493; the agent.l4Routes flag was retired by proposal 031 — each route type now gates only on its Gateway API CRD being installed). (2026-06-22 design.) |
2026-06-22 |
| 017 | VirtualHost CRD — L7 path-based edge routing (supersedes EdgeRoute)virtual-host-l7-routing proposal 003 (edge proxy — the EdgeRoute this replaces), proposal 015 (MeshConfig the controller webhook this extends), proposal 005 (multi-port); project edge proxy plan. | Implemented, then superseded — the VirtualHost CRD shipped, but edge L7 routing has since migrated to the Gateway API (HTTPRoute) and the VirtualHost CRD was retired. See proposal 018. (2026-06-21 design.) → 018 |
2026-06-21 |
| 015 | aether system config (umbrella globals) + proxy MeshConfig CRDmesh-config every telemetry security proposal that added a flag (007, 012, 013, 014); project observability otel, project telemetry edge filter | Implemented — the aether system config + MeshConfig CRD shipped (later made namespaced with an aether-system fallback). Live proxy reload remains future work. (2026-06-18 design.) |
2026-06-18 |
| 014 | proxy access logs to VictoriaLogs over OTLPproxy-access-logs-otlp proposal 007 (telemetry filter), proposal 013 (prober); project observability otel | Implemented — proxy access logs over OTLP shipped and validated (2026-06-17 design). | 2026-06-17 |
| 013 | synthetic mesh-availability probermesh-availability-prober proposal 007 (telemetry filter), proposal 004 (demand-scoped distribution) | Implemented — the mesh-availability prober shipped (charts/prober). (Originally 2026-06-17; amended: probe a proxy local-reply liveness endpoint, not a real service.) |
2026-06-17 |
| 012 | aether_stats as a native C++ Envoy extensionaether stats cpp extension proposal 011 (the Rust dynamic-module port) for the chosen direction proposal 007 (telemetry filter), proposal 010 (custom proxy workspace) | Implemented — aether_stats ships as a native C++ extension in the custom proxy workspace (proxy/source/extensions/filters/http/aether_stats/), default-on in the mesh. (2026-06-15 design.) |
2026-06-15 |
| 011 | Port the aether_stats filter into the proxy buildstats-filter-in-proxy-build proposal 010 (custom proxy workspace), proposal 007 (telemetry filter) | Implemented — superseded in direction by proposal 012: the filter rides the custom proxy build as a native C++ extension rather than a bundled dynamic module (this proposal's envoy --mode validate harness lives on as //test/envoy_validate). (2026-06-15 design.) → 012 |
2026-06-15 |
| 010 | Custom Envoy proxy as a separate sibling Bazel workspacecustom-proxy-workspace | Implemented (proposals 010/011/012) — supersedes proposal 009 | 2026-06-15 |
| 009 | Envoy in the Bazel workspace — version alignment, validation, customizationenvoy-in-workspace | Superseded by proposal 010 — spike / investigation, recommendation below (2026-06-14) | 2026-06-14 |
| 008 | Rust in the Bazel build (rules_rust + hermetic_cc_toolchain)rust-in-bazel | Implemented, then superseded by proposal 010 — the rules_rust + hermetic_cc toolchain shipped (#177) and carried the proposal-007 Rust dynamic module (#178), but was removed when aether_stats moved to a native C++ extension in the custom proxy workspace (proposals 010–012). No Rust remains in the tree. (2026-06-13 design.) |
2026-06-13 |
| 007 | Source↔Destination Telemetry via a Rust Dynamic Moduletelemetry-edge-filter | Implemented — the aether_stats source→destination metrics filter shipped and is default-on (later re-based as a native C++ Envoy extension; see proposals 011/012). Phase-1 module validated end-to-end on stock distroless Envoy 1.38.0 (2026-06-13). |
2026-06-13 |
| 006 | multi-region etcd federation (region-scoped registry ownership)multi-region-etcd-federation docs registry-backend-evolution.md (the multi-region directive this implements), proposal 004 (demand-scoped distribution), proposal 000 (in-cluster registrar); project registrar etcd vs ddb, project multicluster registry. | Implemented — the registrar's --peer-etcd replicator (origin-partitioned keys, origin-heartbeat lease) shipped and is exercised by the nightly two-cluster replication e2e gate. (2026-06-20 design.) |
2026-06-20 |
| 005 | Multi-Port Routing per Podmulti-port-routing | Implemented — multi-port routing shipped (endpoint.aether.io/ports, per-port EDS, SNI demux); design validated by spike (Envoy 1.38.0/BoringSSL, 2026-06-13). |
2026-06-13 |
| 004 | Demand-Scoped Service Distributiondemand-scoped-distribution | Implemented — demand-scoped CDS/watch/health-checking shipped as a breaking change (no fallback flag); cold path = ODCDS, including the capture on-demand catch-all (#288). (2026-06-12 design.) | 2026-06-12 |
| 003 | Edge Proxy (North-South Ingress Gateway)edge-proxy | Implemented — PRs #236 (control plane), #237 (EdgeRoute CRD), #238 (chart), #239 (downstream TLS). NOTE: the EdgeRoute CRD described here was later retired; the edge now routes via the Gateway API (Gateway/HTTPRoute) — see proposals 017 and 018. |
2026-06-19 |
| 002 | Agent Concurrency Audit: Config Propagation, Hot Restart, Pod Lifecycleagent-concurrency-audit | All findings fixed — R1+R3 in #109, R2+R4-R8 in #110, follow-on predecessor re-probe in #111 | 2026-06-10 |
| 001 | Hot Restart for the aether-proxy Envoy (Spike)proxy-hot-restart | Implemented — the agent proxy-supervisor hot-restart supervisor shipped (Strategy B), zero-drop validated on talos-main; follow-on audits merged (#109–#111). (2026-06-09 spike.) |
2026-06-09 |
| 000 | In-Cluster Registrar Servicein-cluster-registrar | Implemented | 2026-03-22 |
A number is enough to cite one: /proposals/000/ redirects to
the full URL of that proposal, and keeps working when its title changes.