fix(dpf): wire service VPC slots

Signed-off-by: Frank Spitulski <fspitulski@nvidia.com>

Author: FrankSpitulski

Cargo.lock

@@ -3172,6 +3172,14 @@ impl CarbideConfig {
         Ok(())
     }
 
+    pub(crate) fn validate_service_vpc_slots(&self) -> eyre::Result<()> {
+        eyre::ensure!(
+            self.dpu_config.service_vpc_slot_count == 0 || self.site_global_vpc_vni.is_none(),
+            "dpu_config.service_vpc_slot_count requires site_global_vpc_vni to be unset because service VPCs require distinct HBN VRFs"
+        );
+        Ok(())
+    }
+
     /// validate_supernic_firmware_profiles checks that each profile's inner
     /// part_number and psid match the HashMap keys they are nested under.
     /// Logs a warning for any mismatches (the inner values are authoritative
@@ -5564,6 +5572,26 @@ path = "credentials.yaml"
         assert!(config.validate_web_ui_sidebar_tools().is_err());
     }
 
+    #[test]
+    fn validate_service_vpc_slots_rejects_site_global_vpc_vni() {
+        let mut config: CarbideConfig = Figment::new()
+            .merge(Toml::file(format!("{TEST_DATA_DIR}/min_config.toml")))
+            .extract()
+            .unwrap();
+
+        config.dpu_config.service_vpc_slot_count = 1;
+        assert!(config.validate_service_vpc_slots().is_ok());
+
+        config.site_global_vpc_vni = Some(6_000);
+        assert!(
+            config
+                .validate_service_vpc_slots()
+                .unwrap_err()
+                .to_string()
+                .contains("requires site_global_vpc_vni to be unset")
+        );
+    }
+
     #[test]
     fn periodic_state_republish_defaults_enabled() {
         let config = PeriodicStateRepublishConfig::default();

crates/api-core/src/cfg/file.rs

@@ -307,6 +307,7 @@ pub fn parse_carbide_config(
 
     // Validate that admin-UI tool entries have unique names.
     config.validate_web_ui_sidebar_tools()?;
+    config.validate_service_vpc_slots()?;
     config.api_admission_control.validate()?;
 
     if let Some(config) = &config.dsx_exchange_event_bus {

crates/api-core/src/cfg/load.rs

@@ -21,13 +21,14 @@ use std::collections::BTreeMap;
 use std::fmt::Write;
 
 use carbide_dpf::types::{
-    DHCP_SERVER_SERVICE_NAME, DOCA_HBN_SERVICE_NAME, DOCA_WEAVE_DHCP_AGENT_SERVICE_NAME,
-    DOCA_WEAVE_FLOW_CONTROLLER_SERVICE_NAME, DOCA_XPLANE_SERVICE_NAME, DPU_AGENT_SERVICE_NAME,
-    DTS_SERVICE_NAME, DpuServiceInterfaceTemplateDefinition, FMDS_SERVICE_NAME,
-    OTEL_COLLECTOR_SERVICE_NAME,
+    DHCP_SERVER_SERVICE_NAME, DOCA_HBN_SERVICE_NAME, DOCA_HBN_SERVICE_NETWORK,
+    DOCA_WEAVE_DHCP_AGENT_SERVICE_NAME, DOCA_WEAVE_FLOW_CONTROLLER_SERVICE_NAME,
+    DOCA_XPLANE_SERVICE_NAME, DPU_AGENT_SERVICE_NAME, DTS_SERVICE_NAME,
+    DpuServiceInterfaceTemplateDefinition, FMDS_SERVICE_NAME, OTEL_COLLECTOR_SERVICE_NAME,
 };
 use carbide_dpf::{
     IntOrString, ServiceDefinition, ServiceInterface, ServiceNAD, ServiceNADResourceType,
+    ServiceVpcSlots,
 };
 
 use crate::cfg::file::{
@@ -59,7 +60,6 @@ pub(crate) const DOCA_HBN_SERVICE_HELM_NAME: &str = "doca-hbn";
 pub(crate) const DOCA_HBN_SERVICE_HELM_VERSION: &str = "3.4.0";
 pub(crate) const DOCA_HBN_SERVICE_IMAGE_NAME: &str = "doca_hbn";
 pub(crate) const DOCA_HBN_SERVICE_IMAGE_TAG: &str = "3.4.0-doca3.4.0";
-pub(crate) const DOCA_HBN_SERVICE_NETWORK: &str = "mybrhbn";
 
 /// DHCP Service Definitions
 pub(crate) const DHCP_SERVER_SERVICE_HELM_NAME: &str = "nico-dhcp-server";
@@ -130,50 +130,6 @@ pub(crate) const COMPILE_TIME_IMAGE_TAG: &str = match option_env!("CARBIDE_BUILD
     None => "",
 };
 
-fn doca_hbn_service_interfaces(
-    interfaces: &[DpuServiceInterfaceTemplateDefinition],
-    extra_interfaces: &[String],
-) -> Vec<ServiceInterface> {
-    let mut service_interfaces =
-        dpu_service_interfaces(interfaces, DOCA_HBN_SERVICE_NAME, DOCA_HBN_SERVICE_NETWORK);
-    service_interfaces.extend(extra_interfaces.iter().map(|name| ServiceInterface {
-        name: name.clone(),
-        network: DOCA_HBN_SERVICE_NETWORK.to_string(),
-    }));
-    service_interfaces
-}
-
-/// Generates deterministic service-VPC interface names after checking HBN capacity.
-pub(crate) fn service_vpc_interfaces(
-    interfaces: &[DpuServiceInterfaceTemplateDefinition],
-    slot_count: u32,
-) -> Result<Vec<String>, String> {
-    let mut hbn_interface_names = doca_hbn_service_interfaces(interfaces, &[])
-        .into_iter()
-        .map(|interface| interface.name)
-        .collect::<std::collections::BTreeSet<_>>();
-
-    let total = usize::try_from(slot_count)
-        .ok()
-        .and_then(|slot_count| hbn_interface_names.len().checked_add(slot_count))
-        .ok_or_else(|| "HBN interface count exceeds usize".to_string())?;
-    if total > 32 {
-        return Err(format!(
-            "HBN interface count {total} exceeds the supported maximum of 32"
-        ));
-    }
-
-    let generated = (0..slot_count)
-        .map(|slot| format!("iface_svc_{slot}"))
-        .collect::<Vec<_>>();
-    for name in &generated {
-        if !hbn_interface_names.insert(name.clone()) {
-            return Err(format!("HBN interface name {name:?} is not unique"));
-        }
-    }
-
-    Ok(generated)
-}
 fn dhcp_server_service_interfaces(
     interfaces: &[DpuServiceInterfaceTemplateDefinition],
 ) -> Vec<ServiceInterface> {
@@ -482,9 +438,14 @@ fn reassert_api_owned_value(
 pub(crate) fn doca_hbn_service(
     cfg: &DpfServiceConfig,
     dpu_interfaces: &[DpuServiceInterfaceTemplateDefinition],
-    extra_interfaces: &[String],
+    service_vpc_slots: ServiceVpcSlots,
 ) -> ServiceDefinition {
-    let interfaces = doca_hbn_service_interfaces(dpu_interfaces, extra_interfaces);
+    let mut interfaces = dpu_service_interfaces(
+        dpu_interfaces,
+        DOCA_HBN_SERVICE_NAME,
+        DOCA_HBN_SERVICE_NETWORK,
+    );
+    service_vpc_slots.append_hbn_interfaces(&mut interfaces);
     let mut helm_values = serde_json::json!({
         "image": {
             "repository": cfg.docker_repo_url,
@@ -892,12 +853,12 @@ pub(crate) fn mandatory_services(
     resolved: &DpfResolvedMandatoryServicesConfig,
     bootstrap_ca: &DpfDpuAgentBootstrapCa,
     interfaces: &[DpuServiceInterfaceTemplateDefinition],
-    service_vpc_interfaces: &[String],
+    service_vpc_slots: ServiceVpcSlots,
     node_auth: &NodeAuthConfig,
 ) -> Vec<ServiceDefinition> {
     let mut service_vec = vec![
         dts_service(&resolved.base.dts),
-        doca_hbn_service(&resolved.base.doca_hbn, interfaces, service_vpc_interfaces),
+        doca_hbn_service(&resolved.base.doca_hbn, interfaces, service_vpc_slots),
         dhcp_server_service(&resolved.base.dhcp_server, interfaces),
         dpu_agent_service(&resolved.base.dpu_agent, bootstrap_ca),
         // Not `node_auth.enabled` directly: an operator staging a disable
@@ -974,12 +935,8 @@ mod tests {
 
         // HBN receives p0, p1, the PF, the VF, and the configured external attachment; its SF
         // count and startup YAML agree.
-        let service_vpc_interfaces = service_vpc_interfaces(&interfaces, 1).unwrap();
-        let hbn = doca_hbn_service(
-            &default_doca_hbn_service(),
-            &interfaces,
-            &service_vpc_interfaces,
-        );
+        let service_vpc_slots = ServiceVpcSlots::new(1).unwrap();
+        let hbn = doca_hbn_service(&default_doca_hbn_service(), &interfaces, service_vpc_slots);
         assert_eq!(hbn.interfaces.len(), 5);
         assert_eq!(
             hbn.helm_values.as_ref().unwrap()["resources"]["nvidia.com/bf_sf"],
@@ -1013,16 +970,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn service_vpc_interfaces_are_deterministic_and_capacity_checked() {
-        let interfaces = build_effective_dpu_interfaces(16, None);
-        assert_eq!(
-            service_vpc_interfaces(&interfaces, 2).unwrap(),
-            ["iface_svc_0".to_string(), "iface_svc_1".to_string()]
-        );
-        assert!(service_vpc_interfaces(&interfaces, 15).is_err());
-    }
-
     /// Verifies operator Helm values cannot disconnect HBN's SF request from its interfaces.
     #[test]
     fn hbn_sf_count_remains_topology_derived() {
@@ -1039,7 +986,7 @@ mod tests {
         let interfaces = build_dpu_interfaces_vec();
 
         // Ordinary resource overrides remain effective, while the SF count follows inventory.
-        let hbn = doca_hbn_service(&config, &interfaces, &[]);
+        let hbn = doca_hbn_service(&config, &interfaces, ServiceVpcSlots::default());
         let helm_values = hbn.helm_values.unwrap();
         assert_eq!(helm_values["resources"]["memory"], "8Gi");
         assert_eq!(
@@ -1159,7 +1106,11 @@ mod tests {
     fn hbn_and_dts_omit_image_pull_secrets_by_default() {
         // HBN and DTS pull from the public DOCA registry: no imagePullSecrets unless configured.
         let interfaces = build_dpu_interfaces_vec();
-        let hbn = doca_hbn_service(&default_doca_hbn_service(), &interfaces, &[]);
+        let hbn = doca_hbn_service(
+            &default_doca_hbn_service(),
+            &interfaces,
+            ServiceVpcSlots::default(),
+        );
         assert!(
             hbn.helm_values.unwrap().get("imagePullSecrets").is_none(),
             "HBN must not emit imagePullSecrets without a configured secret"
@@ -1180,7 +1131,7 @@ mod tests {
         let mut hbn_cfg = default_doca_hbn_service();
         hbn_cfg.docker_image_pull_secret = Some("private-pull-secret".to_string());
         assert_eq!(
-            doca_hbn_service(&hbn_cfg, &interfaces, &[])
+            doca_hbn_service(&hbn_cfg, &interfaces, ServiceVpcSlots::default())
                 .helm_values
                 .unwrap()["imagePullSecrets"],
             expected
@@ -1646,12 +1597,18 @@ mod tests {
         let bootstrap_ca = DpfDpuAgentBootstrapCa::default();
 
         let fmds_mode = |node_auth: &NodeAuthConfig| {
-            mandatory_services(&resolved, &bootstrap_ca, &[], &[], node_auth)
-                .into_iter()
-                .find(|s| s.name == FMDS_SERVICE_NAME)
-                .and_then(|s| s.helm_values)
-                .and_then(|v| v.get("useNodeTokens").and_then(serde_json::Value::as_bool))
-                .expect("fmds renders useNodeTokens")
+            mandatory_services(
+                &resolved,
+                &bootstrap_ca,
+                &[],
+                ServiceVpcSlots::default(),
+                node_auth,
+            )
+            .into_iter()
+            .find(|s| s.name == FMDS_SERVICE_NAME)
+            .and_then(|s| s.helm_values)
+            .and_then(|v| v.get("useNodeTokens").and_then(serde_json::Value::as_bool))
+            .expect("fmds renders useNodeTokens")
         };
 
         let derived_on = NodeAuthConfig {