Allow routing-profiles overrides for VPC updates

[bcavnvidia]

#4411 allows routing-profiles overrides for VPC creation.

This PR continues the support through VPC updates. Similarly, each explicitly supplied override replaces the corresponding base-profile value, while omitted properties continue to inherit from the named profile. The operator-controlled internal and access_tier properties cannot be overridden at the VPC level.

Agent also has a minor update to include interface-level profiles in the additional hashing it does to detect config changes.

Related issues

#2624

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

#2624

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Summary by CodeRabbit

• New Features

  • VPC updates now support inline routing-profile overrides.
  • Omitted overrides preserve existing settings; supplied or empty overrides replace settings or restore inheritance.
  • Routing-profile settings are validated and persisted consistently across API updates and reads.

• Bug Fixes

  • Improved validation for unsupported virtualization types, missing profiles, and invalid security-group references.
  • Network caching now refreshes when tenant interface identity or routing-profile settings change.

• Documentation

  • Clarified routing-profile override support for VPC creation and updates.

Walkthrough

VPC update APIs now accept routing-profile overrides with validation, persistence, replacement, and reset semantics. Network version hashing now includes routing-profile state for every tenant interface. Tests cover update rejection, inheritance, persistence, and cache invalidation.

Changes

VPC routing-profile update support

Layer / File(s)	Summary
Update contract and persistence crates/rpc/proto/forge.proto, rest-api/proto/core/src/v1/nico_nico.proto, crates/api-model/src/vpc/mod.rs, crates/rpc/src/model/vpc.rs, crates/api-db/src/vpc.rs, crates/admin-cli/src/rpc.rs	VPC update requests and models now carry optional routing_profile_overrides. Omitted values preserve the database definition. Supplied values replace it. Empty definitions restore inheritance.
Update validation and effective profile resolution crates/api-core/src/handlers/vpc.rs	The handler loads persisted VPC state when required, validates tenant ownership and routing-profile support, resolves the named base profile, and preserves specialized conversion errors before updating.
Update validation coverage and documentation crates/api-core/src/tests/vpc.rs, crates/api-core/src/cfg/README.md	Tests cover rejected updates, unresolved base profiles, replacement, inheritance, persistence, reset behavior, preservation, and virtualization changes. Documentation describes update support and seeded VPC restrictions.

Network version cache hashing

Layer / File(s)	Summary
Tenant interface profile hashing crates/agent/src/main_loop.rs	Network version hashing now includes every tenant interface’s count, identity, profile presence, and resolved routing-profile fields. Tests cover unchanged interfaces and changes to non-first interface state.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant VPCUpdateHandler
  participant RoutingProfileResolver
  participant VpcDatabase
  Client->>VPCUpdateHandler: submit routing_profile_overrides
  VPCUpdateHandler->>VpcDatabase: load persisted VPC
  VPCUpdateHandler->>RoutingProfileResolver: resolve candidate overrides
  RoutingProfileResolver-->>VPCUpdateHandler: return resolved profile
  VPCUpdateHandler->>VpcDatabase: persist validated update
  VpcDatabase-->>Client: return updated VPC

Loading

Possibly related PRs

• NVIDIA/infra-controller#4382: Modifies VPC routing-profile handling in the same VPC tests and related update structures.
• NVIDIA/infra-controller#4411: Extends per-VPC routing-profile override support from creation to updates.
• NVIDIA/infra-controller#4448: Contains related routing-profile documentation and API changes in VPC files.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: support for routing-profile overrides in VPC updates.
Description check	✅ Passed	The description directly explains the VPC update support, inheritance behavior, hashing change, related issue, and testing.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-07-31 23:11:16 UTC | Commit: 83b9adc}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/agent/src/main_loop.rs`:
- Around line 1685-1688: Update the InterfaceChange::ProfilePresence test cases
around second_profile to use RoutingProfile::default() without setting
leak_tenant_host_routes_to_underlay. Keep the profile-present setup focused
solely on presence, then remove it, and apply the same adjustment to the
corresponding cases at the other referenced locations.

In `@crates/api-core/src/handlers/vpc.rs`:
- Around line 180-191: Update the VPC lookup in the handler to use
db::vpc::find_by_with_lock with txn.as_mut() and db::vpc::VpcRowLock::Mutation
before validation. Preserve the existing filter and NotFoundError behavior while
ensuring the row remains locked through update_virtualization and the versioned
write.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0e42c8ef-c9ff-422c-92e2-1979612be275

📥 Commits

Reviewing files that changed from the base of the PR and between 00e989f and 83b9adc.

⛔ Files ignored due to path filters (1)

• rest-api/proto/core/gen/v1/nico_nico.pb.go is excluded by !**/*.pb.go, !**/gen/**, !rest-api/**/*.pb.go

📒 Files selected for processing (10)

• crates/admin-cli/src/rpc.rs
• crates/agent/src/main_loop.rs
• crates/api-core/src/cfg/README.md
• crates/api-core/src/handlers/vpc.rs
• crates/api-core/src/tests/vpc.rs
• crates/api-db/src/vpc.rs
• crates/api-model/src/vpc/mod.rs
• crates/rpc/proto/forge.proto
• crates/rpc/src/model/vpc.rs
• rest-api/proto/core/src/v1/nico_nico.proto

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pull-request-4463.docs.buildwithfern.com/infra-controller