From c0cda32502dfac004bd9996cddfc83a147510b84 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Tue, 25 Aug 2026 12:27:53 -0700 Subject: [PATCH] docs(networking): instances attach to IncusOS-owned fast40 Incus-created vlan= sub-interfaces on fast pass no traffic; only IncusOS-declared VLANs get bridge self-port membership (fleet#12). --- docs/docs/reference/networking/address-plan.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/docs/docs/reference/networking/address-plan.md b/docs/docs/reference/networking/address-plan.md index d124ab9..0165d99 100644 --- a/docs/docs/reference/networking/address-plan.md +++ b/docs/docs/reference/networking/address-plan.md @@ -131,9 +131,15 @@ LAGs, one per MS-02 SFP+ pair: `bond-lab01` (ports 1–2), `bond-lab02` (ports interface. VLANs 30 and 40 are tagged on the three LAGs and port 7: VLAN 30 is the node storage network, and VLAN 40 carries Incus instance traffic so workloads stay off the management plane. These links are not required for -IncusOS management boot. The host-side counterpart is the `vlan_tags` -allow-list converged by the `GilmanLab/fleet` `cluster/` project. Additional -instance VLANs join these links when their first consumer arrives. +IncusOS management boot. The host-side counterpart, converged by the +`GilmanLab/fleet` `cluster/` project, is the `vlan_tags` allow-list plus an +IncusOS-declared VLAN interface per carried VLAN (`fast30`, `fast40`). +Instances must attach to the IncusOS-owned interface (for example macvlan +with `parent=fast40`), never with an Incus-created `vlan=` sub-interface on +`fast`: the visible `fast` device is an IncusOS-internal VLAN-filtering +bridge, and only IncusOS-declared VLANs receive bridge self-port membership, +so other tagged sub-interfaces pass no traffic. Additional instance VLANs +join these links when their first consumer arrives. ## DHCP and DNS ownership