[scotwells]

Summary

Keep private services reachable during control plane outages until access is withdrawn or the VPC is replaced. Time-bounded access continues to enforce its deadline.

Route virtual service addresses through their network attachment so VPC clients can reach private services over TCP and UDP. Secondary network attachments preserve the workload's primary default route.

Test plan

• CI verifies persistent access, policy withdrawal, and bounded authorization.
• Staging VPCs resolve the same private hostname to separate answers over UDP and TCP.
• Kernel tests verify attachment identity checks and memory limits.
• Network tests verify secondary attachments preserve the primary default route.

[ecv]

Approving. The next-hop fix is right, and persistent access is limited to ServiceRoutePolicy writers, which the type comment names as the network control plane. Follow-ups are in #986: roll order for the new pinned map, silent fallback when no next hop exists (IPv4 included), default-route suppression for blackhole and ECMP defaults, and router restart during an API outage. The alert's runbook anchor does not exist yet. One thing for the body: the staging DNS claim has no code or test in this diff, so cite the run that showed it.

[ecv]

Re-approving at a28836b. The new commits report withdrawn attachments, withdraw routes for interfaces that no longer exist, and propagate any lookup error other than not-found. One cost is now in #986: a vanished veth closes the whole node's policy gate until a full rebuild, so every service route on that node drops for that window. Unit Tests were still pending when I approved.