Build a Cloud-Style Fabric Lab, Part 11: End to End

The finale: one request traced live through all eight hops the series built, the five traps ranked by hours lost, and what I would do differently next time. Plus the honest single point of failure the design still carries.

Eleven posts ago this was an empty hypervisor. Now a machine that has never heard of VXLAN, has no route to the fabric, and trusts nothing about this lab can type chat.ocp.lab and talk to a language model. This finale does two things: traces that one request through every layer the series built, with live output at each hop, and then closes with the collected scar tissue, the traps that cost real time and the things I would do differently on the next build.

One request traced hop by hop: DNS, DNAT, firewall routing, six-way VXLAN fan-out, underlay ECMP, the node's advertised /32, eBPF to Envoy TLS termination, and the pod, each hop labeled with the part that built it — Eight hops, eleven posts, one request. Every hop below is shown live.

Hops 1 and 2: a stranger asks a name

The client is the outside test box: its resolver points at the published DNS address, it holds no lab CA, no routes into the fabric, nothing. It asks for chat.ocp.lab and Part 9's external view answers with the published edge address, because from out there, that address is the truth: