Skip to content

[cli] drive the AF_XDP node path through the vtep.Datapath seam (APO-795) #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dilyevsky merged 1 commit into from
Jun 16, 2026
Merged

[cli] drive the AF_XDP node path through the vtep.Datapath seam (APO-795) #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions cli/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ import (
"github.com/apoxy-dev/icx/permissions"
"github.com/apoxy-dev/icx/queues"
"github.com/apoxy-dev/icx/veth"
"github.com/apoxy-dev/icx/vtep/afxdp"
)

func main() {
Expand Down Expand Up @@ -441,17 +442,24 @@ func run(c *cli.Context) error {
if err != nil {
return fmt.Errorf("failed to create forwarder: %w", err)
}
// Drive the AF_XDP forwarder through the vtep.Datapath seam rather than calling
// forwarder.Start directly: the per-node VTEP is just one Datapath shape (afxdp),
// and routing its lifecycle through the seam lets the other drivers (tun, netstack)
// reuse the same engine/control wiring. afxdp.Wrap takes ownership of the forwarder
// and its in-place, shared-UMEM hot loop unchanged — Run delegates to Start (which
// self-closes the forwarder on return), so the node data path stays byte-identical.
dp := afxdp.Wrap(fwd)

// Run the rekey loop and the forwarder under one errgroup sharing a cancel: a signal
// (ctx) or a forwarder error stops both. The control plane reconnects indefinitely on
// Run the rekey loop and the datapath under one errgroup sharing a cancel: a signal
// (ctx) or a datapath error stops both. The control plane reconnects indefinitely on
// its own (Tunnel.Run does not return on CP failures), so it does not abort the
// forwarder; if it cannot re-establish, the data plane fails closed when the installed
// datapath; if it cannot re-establish, the data plane fails closed when the installed
// keys expire (see key lifetime below).
g, gctx := errgroup.WithContext(ctx)
g.Go(func() error { return tun.Run(gctx) })
g.Go(func() error {
if err := fwd.Start(gctx); err != nil && !errors.Is(err, context.Canceled) {
return fmt.Errorf("forwarder: %w", err)
if err := dp.Run(gctx); err != nil && !errors.Is(err, context.Canceled) {
return fmt.Errorf("datapath: %w", err)
}
return nil
})
Expand Down
Loading