Validated types for expose, manifest, peering, VPC, etc.

[qmonnet]

This is a PR to introduce "validated" types for VpcExpose, VpcManifest, Peering, Vpc, VpcTable, Overlay, ExternalConfig, and GwConfig objects (all cascading from the validated expose blocks).

There are two main objectives: one is to provide "vetted types" holding true some invariants, so that the compiler can reason based on that. We don't leverage this aspect that much in the PR, but the split of types between the pre-validation and post-validation stage should help for using more assumptions in the future.

The second objectif is to move some of the processing for the expose blocks to an earlier location, and make the processed prefixes available everywhere down the line. More specifically, we used to call three times the helper for "collapsing" exclusion prefixes into the allowed prefixes: once for the stateless NAT, once for the masquerading, and one for the flow-filter context builds. After the changes, we only run it once, and can expose a list of "validated" expose blocks to every location that needs it, after that.

The Pull Request is large, because the changes propagate, a lot. I think I did a reasonable job at splitting the first commits; but the last part is horrible, because there's no easy way to go incrementally with the changes once we start to propagate the new types to the consumers. So we've got some huuuuuge commits... and no real way to make it easy to review, sorry.

The code is mine, I've used Claude to rebase it (multiple times) on the recent NAT changes, as well as to assist, to some extent, to the commit split.

Feedback welcome on the new "validated" wrapper types.

[Copilot]

Pull request overview

This PR introduces “validated” wrapper types across the overlay/VPC/expose configuration model (and downstream consumers) so that post-validation invariants are represented in the type system. It also moves exclusion-prefix collapsing earlier (during validation) so consumers reuse pre-collapsed prefix sets instead of recomputing them in multiple places.

Changes:

• Add validated newtypes (e.g., ValidatedGwConfig, ValidatedOverlay, ValidatedVpcTable, ValidatedPeering, ValidatedManifest, ValidatedExpose) and update mgmt/routing/NAT/flow-filter to consume them.
• Collapse exclusion prefixes once during expose validation and propagate the collapsed view (valexp) through manifests/peerings/VPCs.
• Update tests and dev-dependencies to use testing-only helpers for minting validated wrappers where configs are intentionally invalid.

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
validator/src/main.rs	Adjusts config validation call site to new GwConfig::validate API.
routing/src/router/rio.rs	Stores applied config as Arc<ValidatedGwConfig> in router runtime state.
routing/src/router/ctl.rs	Updates control messages/APIs to pass validated config types.
routing/src/cli/handler.rs	Updates CLI “show config” paths to use validated getters.
nat/src/stateless/test.rs	Migrates stateless NAT tests to ValidatedGwConfig and validated peerings.
nat/src/stateless/setup/mod.rs	Stateless NAT table building now consumes validated VPC/peering/expose types.
nat/src/stateful/test.rs	Migrates stateful NAT tests to validated config/overlay accessors.
nat/src/stateful/flows.rs	Updates flow checks to use validated manifests/exposes.
nat/src/stateful/apalloc/test_alloc.rs	Updates allocator tests to use validated VPC tables and validated peering data.
nat/src/stateful/apalloc/setup.rs	Updates allocator setup to use validated peering/manifest/expose accessors.
nat/src/stateful/allocator_writer.rs	Makes StatefulNatConfig derived from ValidatedVpcTable and stores validated peerings.
nat/src/portfw/portfwtable/setup.rs	Port-forwarding table builder now consumes validated overlay/VPC/peering/expose types.
nat/Cargo.toml	Enables config’s testing feature for NAT crate tests.
mgmt/src/tests/mgmt.rs	Updates mgmt test utility to validate and use ValidatedGwConfig.
mgmt/src/processor/proc.rs	Processor pipeline now validates upfront and applies ValidatedGwConfig throughout.
mgmt/src/processor/mgmt_client.rs	Exposes “current config” as Arc<ValidatedGwConfig>.
mgmt/src/processor/k8s_client.rs	Updates status timestamp reads to use validated meta accessor.
mgmt/src/processor/gwconfigdb.rs	Stores applied config as Arc<ValidatedGwConfig> and seeds blank validated config.
mgmt/src/processor/confbuild/router.rs	Router config generation now takes validated config.
mgmt/src/processor/confbuild/internal.rs	Internal config build now consumes ValidatedGwConfig/ValidatedOverlay.
lpm/src/prefix/with_ports.rs	Adds prefix-set size utility used by validation; makes ppsize_zero const fn.
flow-filter/src/tests.rs	Updates tests to use validated overlays; uses test-only unsafe validation escapes for invalid configs.
flow-filter/src/setup.rs	Flow-filter table build now consumes ValidatedOverlay and uses validated manifests/exposes.
flow-filter/Cargo.toml	Enables config’s testing feature for flow-filter crate tests.
config/src/utils/overlap.rs	Overlap checking now operates on validated (already-collapsed) expose prefix sets.
config/src/utils/mod.rs	Updates collapse helper export visibility/name to collapse_prefixes.
config/src/utils/collapse.rs	Refactors collapse helper to operate at expose level; updates tests accordingly.
config/src/lib.rs	Re-exports ValidatedGwConfig from the config crate.
config/src/gwconfig.rs	Adds ValidatedGwConfig wrapper; changes GwConfig::validate to consume and return validated type.
config/src/external/overlay/vpcpeering.rs	Adds ValidatedExpose/ValidatedManifest; validates/collapses exposes into valexp.
config/src/external/overlay/vpc.rs	Adds validated wrappers for peering/VPC/VPC table; validation now populates validated views.
config/src/external/overlay/validation_tests.rs	Updates tests for new validation return types and semantics.
config/src/external/overlay/tests.rs	Updates overlay tests for new manifest/peering validation APIs and messages.
config/src/external/overlay/mod.rs	Adds ValidatedOverlay and test-only manifest validation bypass helper.
config/src/external/mod.rs	Adds ValidatedExternalConfig accessor wrapper used by ValidatedGwConfig.
config/src/display.rs	Adds display support for validated overlay/VPC/peering/expose structures.
config/Cargo.toml	Adds testing feature to expose test-only unsafe constructors in downstream crates’ tests.

[daniel-noland]

I don't love the amount of casting happening here, nor do I really understand the motive for them when we could have just made another type. That said, this is a significant improvement in any case so I'll approve

[qmonnet]

I don't love the amount of casting happening here, nor do I really understand the motive for them when we could have just made another type.

Introducing other types is doable, but means we need to re-build all the objects when we validate (copying all exposes and their prefixes, manifests, peerings, VPCs) to build the new ones. The performance hit is probably not too big, but I didn't really see any advantage in doing that. If you strongly feel for the new types, though, I can go that way.

That said, this is a significant improvement in any case so I'll approve

Thank you! I'll leave it a couple more days in case somebody else wants to review, and then I'll click the green button.

[qmonnet]

@daniel-noland @mvachhar We're now using separate structs for the validated types, see the last 7 commits. The previous commits are unchanged (only rebased on main). One consequence is that the new struct ValidatedManifest no longer stores the original VpcExpose, so the config build for the various components entirely relies on the validated config - including for the routing config build (Cc @Fredi-raspall). The change is in commit 217b414. As a reminder, the ValidatedExpose differ from the VpcExpose in that they only contain allowed prefixes, no exclusion prefixes.

Please take another look when you can.