Overview

Architecture

The daemons, the dataplane, and how a declarative config becomes forwarded packets.

A SiHA node is one immutable image running a handful of cooperating processes: a dataplane (VPP) that moves packets, and a control plane that decides how.

The processes

A tiny supervisor is PID 1. It performs platform init (mounts, signal handling, reaping), reads the platform seed, bootstraps the node’s PKI, then spawns and supervises everything else — each child with its own in-memory log ring.

ProcessRole
supervisor (PID 1)Platform init, process supervision, the A/B health-gate + rollback, and a RestartVPP RPC used by the 2-phase dataplane apply.
pilotdThe brain. Reconciles COSI resources (interfaces, ACLs, NAT, routes, VIPs…) into VPP over its binary API.
apidThe gRPC front door on :6443. Authenticates clients with mTLS and forwards to the pilotd / supervisor sockets.
probedHealth-checks load-balancer backends and publishes status the LB stack reads to filter live backends.
metricsdAttaches the VPP stats shared-memory segment and serves real-time metrics, apart from the control-plane hot path.
VPPThe dataplane process itself — DPDK poll-mode by default.

There is no SSH, no systemd, and no cloud-init on the appliance. You reach a node only through sihactl over mTLS.

From resource to packet

Everything is declarative. You apply a resource; the control plane converges the dataplane to match it:

  1. sihactl sends your resource to apid over mTLS.
  2. apid forwards it to pilotd, which stores it and wakes the matching controller.
  3. The controller reconciles: it computes the delta and programs VPP through the binary API (creating an interface, installing an ACL, adding a NAT mapping, a route, a VIP…).
  4. VPP forwards traffic accordingly. Status flows back up so sihactl get shows the observed state.
SiHAVPP DATAPLANE · packet pathNICDPDKingress ›NICDPDK› egress01parsel2 / l3 / l402aclpermit / deny03nat44translate04routefib lookup05balancepick backend

Reconciliation, not fire-and-forget

Each controller runs a reconcile loop: it re-derives the desired dataplane state from the resources and corrects drift. Crucially, controllers subscribe to VPP reconnects — if VPP restarts, caches that reference stale indices are wiped and state is rebuilt, so the control plane never lies about what the dataplane is actually doing.

The dataplane’s own configuration (startup.conf) is itself owned by a controller and applied with a last-known-good, health-checked two-phase restart: snapshot the current config, write the new one, restart VPP, probe it twice — and on failure, restore the previous config and mark the node degraded.

Next: the resource model you apply, and the sihactl commands that apply it.