User ACLs documentation - #338
Merged
Merged
Conversation
|
🚀 Deployed on https://preview-338--hedgehog-docs.netlify.app |
qmonnet
force-pushed
the
pr/qmonnet/user-acls
branch
from
July 30, 2026 12:35
714aec5 to
8fa6f10
Compare
qmonnet
force-pushed
the
pr/qmonnet/user-acls
branch
from
July 31, 2026 23:43
8fa6f10 to
e14e439
Compare
qmonnet
marked this pull request as ready for review
July 31, 2026 23:44
qmonnet
commented
Aug 2, 2026
edipascale
reviewed
Aug 3, 2026
edipascale
left a comment
edipascale
left a comment
Contributor
There was a problem hiding this comment.
LGTM, only minor comments and one typo
qmonnet
force-pushed
the
pr/qmonnet/user-acls
branch
from
August 3, 2026 13:25
e14e439 to
fc406f9
Compare
Member
Author
|
Thank you Emanuele, I should have addressed all your comments, please take a look at the diff when you can. |
edipascale
previously approved these changes
Aug 3, 2026
edipascale
left a comment
edipascale
left a comment
Contributor
There was a problem hiding this comment.
Thanks for addressing my comments!
mvachhar
requested changes
Aug 4, 2026
The gateway "overview" has grown to the point it's no longer an overview, but mostly a reference guide for the GatewayPeering configuration. Move the peering material into a new gateway-peering.md. The text is carried over unchanged, apart from heading levels (and this commit is best reviewed with some tool that shows lines moved rather than just additions/deletions). Section "Flow Table and Stateful Processing" gets split in two parts, because it mixed two concerns: the flow table capacity, and observations on the non-shared nature of flow states, are properties of the gateway node, whereas timeout-based eviction is a per-peering NAT field. The former stay in gateway.md, the latter (along with the keepalive tip) move to the new gateway-peering.md in a dedicated "Flow Table" subsection. Minor introduction paragraphs are added to replace the section that moved, or as introduction to the new page and subsection. We also update relevant links, and .pages navigation. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Quentin Monnet <qmo@qmon.net>
When one side of a gateway peering uses stateful NAT (masquerade or port forwarding), the other side cannot also use stateful NAT, but we added support for using stateful NAT and static NAT on opposing ends of a peering. Update the relevant limitation in the docs. Signed-off-by: Quentin Monnet <qmo@qmon.net>
qmonnet
force-pushed
the
pr/qmonnet/user-acls
branch
from
August 4, 2026 13:59
fc406f9 to
8067894
Compare
Signed-off-by: Quentin Monnet <qmo@qmon.net>
qmonnet
force-pushed
the
pr/qmonnet/user-acls
branch
from
August 4, 2026 23:38
8067894 to
fdfbb86
Compare
mvachhar
approved these changes
Aug 5, 2026
mvachhar
left a comment
mvachhar
left a comment
Contributor
There was a problem hiding this comment.
This can be merged as is, but we still need to answer the questions about flow scoped rules and how they interact with packet scoped rules. I'm still in favor of my interpretation, but @qmonnet has a good point on people getting burned by a packet level deny for return traffic that gets bypassed. We should decide on final semantics and document any gotchas.
qmonnet
enabled auto-merge (rebase)
August 5, 2026 15:19
mrbojangles3
self-requested a review
August 5, 2026 16:15
Frostman
approved these changes
Aug 7, 2026
Frostman
disabled auto-merge
August 7, 2026 17:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes: #331