feat(): Hub-and-Spoke spoke-to-spoke routing for worker-operator

[Shreesha001]

Description

Worker-operator side of the Hub-and-Spoke (partial mesh) feature.

What's included:

• a spoke's gateway routes the whole slice subnet to the hub, programmed on both the gateway pod and the slice router, so spoke-to-spoke traffic is relayed through the hub (feat(): route entire slice subnet via hub for spoke gateways #496)
• the worker derives each gateway's tunnel state from its pod statuses and writes it back to the hub WorkerSliceGateway status - ConnectionState (Connected / NotConnected / Pending), Reason, Message and LastTransitionTime - so the controller can tell when the topology has converged (Worker: Report per-peer connectivity status and reasons (Partial Mesh MVP) #471, feat(): report gateway tunnel connectivity to hub WorkerSliceGateway status (#471) #495). Reason/Message are now populated (Connected -> TunnelEstablished, NotConnected -> TunnelDown, Pending -> Reconciling); these were placeholder fields earlier.

Part of #471, #496

How Has This Been Tested?

• Unit tests: route selection, RouteEntireSliceSubnet flag propagation on the hub controller, and gateway connection status (derive state, reconcile write, reason/message mapping).
• Real 4-cluster run on OpenVPN: spoke-to-spoke ping and iperf through the hub, gateway failover, tunnel-down recovery.

Full details and commands are in the controller's docs/hub-and-spoke-testing.md.

Checklist:

• The title of the PR states what changed and the related issue number.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• I have performed a self-review of my own code.
• I have commented my code in hard-to-understand areas.
• I have added the required unit test cases.

Does this PR introduce a breaking change for other components like worker-operator?

No. It reads the new RouteEntireSliceSubnet and status fields added by the controller. Spoke-to-spoke only works when the matching controller and gateway-sidecar changes are also deployed.

[Copilot]

Pull request overview

Implements the worker-operator side of Hub-and-Spoke (spoke-to-spoke via hub) by propagating a “route entire slice subnet” flag into dataplane programming and reporting gateway tunnel connectivity back to hub-side WorkerSliceGateway status for controller convergence/health aggregation.

Changes:

• Propagates RouteEntireSliceSubnet into the worker’s gateway/slice-router programming so spokes forward all slice-internal traffic to the hub for relaying.
• Adds hub reconciler logic + unit tests to derive and write per-gateway tunnel ConnectionState/Reason/Message/LastTransitionTime onto WorkerSliceGateway.status, with periodic refresh.
• Updates vendored kubeslice/apis (via go.mod replace) and CRD/schema pieces to include the new fields/flags.

Reviewed changes

Copilot reviewed 10 out of 16 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
controllers/slicegateway/slicegateway.go	Computes remote subnet routing target (peer subnet vs entire slice subnet) and programs that into gateway pods + slice router.
controllers/slicegateway/slicegateway_route.go	Adds shared helper to choose remote NSM subnet for normal vs entire-slice routing.
controllers/slicegateway/slicegateway_route_test.go	Unit tests for route-selection helper.
pkg/hub/controllers/slicegateway_controller.go	Propagates route flag into mesh SliceGateway config and periodically reports tunnel connectivity to hub status.
pkg/hub/controllers/slicegateway_status.go	Implements tunnel state aggregation and status update with conflict retries + state→reason/message mapping.
pkg/hub/controllers/slicegateway_status_test.go	Unit tests for connection-state derivation and hub status reconciliation behavior.
pkg/hub/controllers/slicegateway_config_test.go	Unit tests for route flag propagation into mesh SliceGateway config and change detection.
api/v1beta1/slicegateway_types.go	Adds RouteEntireSliceSubnet to SliceGateway config API.
config/crd/bases/networking.kubeslice.io_slicegateways.yaml	Extends CRD schema to expose routeEntireSliceSubnet in SliceGateway config.
go.mod	Adds replace to point github.com/kubeslice/apis to an external fork/commit.
go.sum	Updates sums for the replaced apis module.
vendor/modules.txt	Records vendored module replacement mapping for kubeslice/apis.
vendor/github.com/kubeslice/apis/pkg/worker/v1alpha1/workerslicegateway_types.go	Adds RouteEntireSliceSubnet to spec and connection-status fields/constants to WorkerSliceGatewayStatus.
vendor/github.com/kubeslice/apis/pkg/worker/v1alpha1/zz_generated.deepcopy.go	Updates deepcopy generation for new status fields (e.g., LastTransitionTime).
vendor/github.com/kubeslice/apis/pkg/controller/v1alpha1/cluster_types.go	Vendored apis update adds storage capability types to ClusterStatus.
vendor/github.com/kubeslice/apis/pkg/controller/v1alpha1/zz_generated.deepcopy.go	Updates deepcopy generation for new controller-side types.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 16 changed files in this pull request and generated 1 comment.

Suppressed comments (5)

Previously missed (3) — in code that hasn't changed since the last review.

pkg/hub/controllers/slicegateway_status.go:78

• The NotConnected message claims all pods report the tunnel is down, but deriveGatewayConnectionState also returns NotConnected for non-UP states like "UNKNOWN" (see pkg/gwsidecar/getTunnelState). This can mislead operators; consider wording that matches the actual aggregation logic (no pods report UP).

		return "TunnelDown", "all gateway pods report their tunnel is down"

pkg/hub/controllers/slicegateway_status_test.go:125

• This subtest name says "no write" but the reconciler may still update status to backfill Reason/Message even when ConnectionState is unchanged. Renaming it to match what it actually asserts (no LastTransitionTime churn) will reduce confusion when reading test failures.

This issue also appears on line 133 of the same file.

	t.Run("no write when state is unchanged", func(t *testing.T) {

pkg/hub/controllers/slicegateway_status_test.go:150

• If you update the NotConnected message in reasonMessageForState to be more accurate (e.g., "no gateway pods report their tunnel is up"), the expected message here should be kept in sync so the test continues to validate the mapping.

		spokev1alpha1.GatewayConnectionStateNotConnected: {"TunnelDown", "all gateway pods report their tunnel is down"},

go.mod:106

• The go.mod replace points to a personal fork (github.com/Shreesha001/apis). This increases supply-chain and long-term maintenance risk (availability, ownership changes, provenance). Prefer an organization-owned fork or an upstream release, and document when/how this replace will be removed once the upstream change lands.

replace github.com/kubeslice/apis => github.com/Shreesha001/apis v0.0.0-20260716162233-4dfda414c6d2

pkg/hub/controllers/slicegateway_status_test.go:133

• This comment claims there is "no update", but reconcileGatewayConnectionStatus may still perform a status update to populate Reason/Message while keeping LastTransitionTime unchanged. Consider rewording to reflect the actual assertion.

		// all pods down -> NotConnected, same as current -> no update, no timestamp.