test(config,mgmt,k8s-intf): generate valid configurations and property-test the validator - #1737

Draft

daniel-noland wants to merge 20 commits into

pr/daniel-noland/fuzz-flow-entryfrom

pr/daniel-noland/fuzz-config-generators

Commits on Aug 21, 2026

feat(config): Generate port-forwarding exposes for property tests

authored and
mvachhar
committed
b277382
feat(config): Generate masquerade exposes, and share the overlay around them

authored and
mvachhar
committed
daf68cd
feat(config): Generate static NAT exposes, and pin the mapping is a bijection

authored and
mvachhar
committed
7ee7262
fix(config): Refuse a port-forwarding expose the dataplane cannot build

authored and
mvachhar
committed
1fbaae9
refactor(config): Report a port-forwarding mismatch as a typed error

authored and
mvachhar
committed
885c9bd
test(mgmt): Property-test the configuration chain, and unblock its generators

authored and
mvachhar
committed
584ed19
test(mgmt): Drive the config builder with generated NAT peerings

authored and
mvachhar
committed
d3b5397
test(k8s-intf): Generate configurations that are valid by construction

authored and
mvachhar
committed
c9765c8
test(k8s-intf): Generate peering ACLs

authored and
mvachhar
committed
6bf1920
test(mgmt): Build every dataplane table a validated config implies

authored and
mvachhar
committed
f619ac1
test(config): Hunt validator permissiveness with near-miss configurations

authored and
mvachhar
committed
e707a97
test(mgmt): Let a fuzzing engine drive the near-miss property

authored and
mvachhar
committed
fb34b0c
test(k8s-intf): Draw prefixes from slots so exposes cannot overlap

authored and
mvachhar
committed
5bb06e5
fix(k8s-intf): Give every vpc its own slots, and assert the control validates

authored and
mvachhar
committed
ff099c1
test(mgmt): Check that a validated configuration has only one meaning

authored and
mvachhar
committed
1f8a89f
test(config): Assert the validator refuses what a mutation certainly breaks

authored and
mvachhar
committed
deea724
test(nat): Catch a static NAT table that holds one of two rules asked for

authored and
mvachhar
committed
6321c7d
fix(k8s-intf): Put the generated gateway in its own gateway groups

authored and
mvachhar
committed
2a2d7ee
test(mgmt): Check that every expose leaves a trace

authored and
mvachhar
committed
6948379
test(mgmt): Follow the genid out of MasqueradeConfig

authored and
mvachhar
committed
1f73a35

Navigation Menu

Uh oh!

test(config,mgmt,k8s-intf): generate valid configurations and property-test the validator - #1737

test(config,mgmt,k8s-intf): generate valid configurations and property-test the validator#1737
daniel-noland wants to merge 20 commits into
pr/daniel-noland/fuzz-flow-entryfrom
pr/daniel-noland/fuzz-config-generators

Commits on Aug 21, 2026

feat(config): Generate port-forwarding exposes for property tests

feat(config): Generate masquerade exposes, and share the overlay around them

feat(config): Generate static NAT exposes, and pin the mapping is a bijection

fix(config): Refuse a port-forwarding expose the dataplane cannot build

refactor(config): Report a port-forwarding mismatch as a typed error

test(mgmt): Property-test the configuration chain, and unblock its generators

test(mgmt): Drive the config builder with generated NAT peerings

test(k8s-intf): Generate configurations that are valid by construction

test(k8s-intf): Generate peering ACLs

test(mgmt): Build every dataplane table a validated config implies

test(config): Hunt validator permissiveness with near-miss configurations

test(mgmt): Let a fuzzing engine drive the near-miss property

test(k8s-intf): Draw prefixes from slots so exposes cannot overlap

fix(k8s-intf): Give every vpc its own slots, and assert the control validates

test(mgmt): Check that a validated configuration has only one meaning

test(config): Assert the validator refuses what a mutation certainly breaks

test(nat): Catch a static NAT table that holds one of two rules asked for

fix(k8s-intf): Put the generated gateway in its own gateway groups

test(mgmt): Check that every expose leaves a trace

test(mgmt): Follow the genid out of MasqueradeConfig