[Feature] Octavia load-balancer attribution

[arasHi87]

Description

Re-attribute Octavia LB traffic to the real end-user tenant instead of the service project. Two-segment model: tag Amphora MACs at cold-start (primary mechanism); optional bpf_skb_ct_lookup at the Amphora tap refines Segment-1 zone from the pre-NAT client IP.

Definition of Done (DoD)

• amphora_meta sidecar map keyed by Amphora MAC — superseded. The marker is packed into the top bit of the existing mac_tenant_map value instead: a sidecar map costs ~20–30 ns per packet whose peer resolves, against a measured 82–110 ns budget, to carry one bit. A second map was still needed, but keyed differently — see the note below.
• Octavia API client enumerates Amphorae at cold-start — and re-enumerates every reconcile pass. The join keys on the Amphora's compute_id, not its vrrp_port_id: Octavia plugs an Amphora into an off-subnet member's network by handing Nova a network with no port, and Nova then mints a port with no Octavia marker and no allowed-address pair (verified live). Any narrower join leaves that traffic billing the operator.
• Two-tap asymmetry distinguishes Amphora vs backend tap — superseded. Tap identity turned out to be the wrong discriminator: both segments cross the same taps. The Amphora's own address is what separates them — VIP means Segment 1, base address means Segment 2 — via a small tenant-scoped amphora_base_ip set, probed only when the marker bit is set.
• Segment-2 → INFRA, attributed to LB owner — with one correction to the original model: attribution follows the VM whose tap saw the packet, never the peer. Peer-based attribution would put a server_id under a tenant_id that does not own it, breaking Contract 7's total → tenant → server → port nesting. In the ordinary topology the two coincide.

Technical Notes

Deferred (target deployments use the amphora provider only — verified). DESIGN §6 / Scenario F. OVN-native provider explicitly out of scope.

Story Points: 8 (Very High — extreme complexity or high uncertainty).

Output artifacts (Definition of Done)

Beyond code, docs, and config changes, completing this issue must also deliver:

• Handbook knowledge update — land the durable, team-readable knowledge from this
  work into the bigstack-handbook cubecos kb (kb/cubecos/…) via
  /bigstack-core:save-to-handbook (Topic / Runbook / Known-issue / ADR as fits).

[bigstack-ci-bot]

🤖 Board reconciler applied 1 correction(s) to this ticket:

• Status: Backlog → Todo (S3 — Todo means picked into a sprint; set a Planned Sprint at sizing to bring it back)

_{Derived from ground truth (close reason · PR state · Planned Sprint · sprint calendar). If a correction is wrong, fix that ground truth — the reconciler follows it on the next sweep.}

[arasHi87]

Delivered by #298 (8 commits, rebase-merged) and documented in bigstack-oss/bigstack-handbook#279.

What ships: an Amphora's data ports are re-attributed from the Octavia service project to the load balancer's owner, Segment 2 zones infra, and Segment 1 keeps the client's own zone.

Two design items in the DoD above were superseded during the build; both are annotated inline rather than silently ticked. A third correction is worth recording because an intermediate commit shipped it wrong: a4a7ba1 zoned any L2-adjacent flow touching an Amphora as infra, which made an internal cross-tenant client's load-balancer request free in both directions. 1b06184 fixes it with the base-address test, and the live scenario asserts it so it cannot come back.

Live validation — c36, 2026-08-17. scenariotest run octavia-lb-attribution, all 8 assertions PASS: ACTIVE_STANDBY (MASTER+BACKUP), three pool members across two subnets, internal same-tenant client, internal cross-tenant client, external client via a floating IP on the VIP port.

tenant	zone	dir	delta
T1	same_tenant	tx/rx	4.0 MiB
T2	other_tenant	tx	4.0 MiB
T1	other_tenant	rx	4.0 MiB
T1	external	tx/rx	4.1 MiB
T1	infra	tx/rx	12.1 MiB

infra = 12.1 MiB is exactly the three flows' payload — every byte through the load balancer identified as Segment 2 plumbing. Per-packet cost 26 ns, bench-gate green, zero allocations.

Two cluster prerequisites, both of which present as product bugs and are recorded in the handbook entry:

• [libvirt] num_pcie_ports unset ⇒ an Amphora boots with no spare PCIe slots, so cross-subnet member plugs fail No more available PCI slots while the load balancer stays ACTIVE. Set to 28 on c36's computes.
• ACTIVE_STANDBY comes from an Octavia flavorprofile, not a per-LB flag. Staged lachesis-ha on c36.

Deferred, registered rather than dropped:

• Conntrack refinement of Segment 1 — docs/architecture/contracts.md deferred item 0. Unnecessary in the common case: external client IPs survive FIP DNAT.
• Per-backend byte counts — out of scope for the data plane; the source would be Octavia's PROMETHEUS listener, a userspace collector.
• OVN provider — different shape, and safe by construction since it has no Amphora for the join to match.

Follow-up worth its own ticket: CI runs golangci-lint but there is no lint target in the Taskfile, so it is not part of task test / task ci. Adding one surfaces two pre-existing SA5011 findings in internal/neutron/resolve_test.go that CI does not flag, so it needs its own change rather than riding this one.