Keel-Linux/keel
1
0
Fork 0
Code Issues 36 Pull requests 8 Projects Releases Packages Wiki Activity Actions

feat: every overlay peer gets PersistentKeepalive = 25 (keel#140) #144

Open
marcos-mendez wants to merge 1 commit from feat/mesh-keepalive into main
pull from: feat/mesh-keepalive
merge into: Keel-Linux:main
Conversation 0 Commits 1 Files changed 12 +103 -15
marcos-mendez commented 2026-10-10 16:24:43 -03:00 (Migrated from github.com)
Copy link

Follow-up of #143 for #140. Decision: the coordinator's, 2026-10-10. Turn on PersistentKeepalive = 25 for every mesh peer, so that the 180 s handshake drift means "unreachable" and the NAT/firewall state stays open between sites.

Change

  • keel/network/wireguard.py: DEFAULT_KEEPALIVE = 25 and keepalive(). render writes PersistentKeepalive for every peer: the spec's value, else 25.
  • keel/network/switch.py (keepalive_only): keel spec apply sets the keepalive live with wg set. A change that only sets the keepalive of a peer that the interface holds cannot cut the node off, so it counts as an addition does (added_live, keel#117). keel mesh keeps it with no handshake, so the first sync after the upgrade does not wait for one.
  • keel/diff/compare.py (with_overlay_defaults): a peer that gives no keepalive declares 25. A file written before this version is drift (network.overlay.wireguard.peers.<key>.persistent_keepalive) until apply writes it again.
  • Docs: docs/spec.md, docs/diff.md, docs/apply.md. Version 0.23.17 (#142 holds 0.23.16).

Tests

  • tests/test_network_wireguard.py: render and the default.
  • tests/test_inspect_overlay.py: keel diff says same for a file with the line, and drift for a file without it.
  • tests/test_network_overlay_live.py: a change that only sets the keepalive counts as safe; an endpoint change does not.
  • The mesh netns suites (3-node, 4-node, late-add, live-peers) pass locally.
Follow-up of #143 for #140. Decision: the coordinator's, 2026-10-10. Turn on PersistentKeepalive = 25 for every mesh peer, so that the 180 s handshake drift means "unreachable" and the NAT/firewall state stays open between sites. ## Change - `keel/network/wireguard.py`: `DEFAULT_KEEPALIVE = 25` and `keepalive()`. `render` writes `PersistentKeepalive` for every peer: the spec's value, else 25. - `keel/network/switch.py` (`keepalive_only`): keel spec apply sets the keepalive live with `wg set`. A change that only sets the keepalive of a peer that the interface holds cannot cut the node off, so it counts as an addition does (`added_live`, keel#117). keel mesh keeps it with no handshake, so the first sync after the upgrade does not wait for one. - `keel/diff/compare.py` (`with_overlay_defaults`): a peer that gives no keepalive declares 25. A file written before this version is drift (`network.overlay.wireguard.peers.<key>.persistent_keepalive`) until apply writes it again. - Docs: `docs/spec.md`, `docs/diff.md`, `docs/apply.md`. Version 0.23.17 (#142 holds 0.23.16). ## Tests - `tests/test_network_wireguard.py`: render and the default. - `tests/test_inspect_overlay.py`: keel diff says same for a file with the line, and drift for a file without it. - `tests/test_network_overlay_live.py`: a change that only sets the keepalive counts as safe; an endpoint change does not. - The mesh netns suites (3-node, 4-node, late-add, live-peers) pass locally.
This pull request has changes conflicting with the target branch.
  • debian/changelog
  • keel/__init__.py
  • pyproject.toml
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/mesh-keepalive:feat/mesh-keepalive
git switch feat/mesh-keepalive
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accessibility

Barrier affecting people with disabilities

  
bug

Something isn't working

  
documentation

Improvements or additions to documentation

  
duplicate

This issue or pull request already exists

  
enhancement

New feature or request

  
good first issue

Good for newcomers

  
help wanted

Extra attention is needed

  
invalid

This doesn't seem right

  
question

Further information is requested

  
wontfix

This will not be worked on

No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Keel-Linux/keel!144
No description provided.