[Semen Kolesnikov (Lotarcc)]

Remote nodes skip gateway peers without pod CIDRs (configureTunnelPeers), so the gateway's routed CIDRs never get BPF entries and remote -> local traffic through it fails. A gateway in a Site with manageCniPlugin: false should not have a podCIDR at all; today it only works because the controller assigns a stray one. #943 stops that assignment, so new gateways in unmanaged Sites hit this.

A gateway peer without pod CIDRs is now programmed when its Site is unmanaged and it has routed CIDRs. Managed-Site gateways still wait for their podCIDR, as before (they publish their WireGuard key before CNI setup).

This PR used to also skip podCIDR assignment in the controller. #943 does that more cleanly, so this is now the node-side piece only. Happy to fold it into #943 instead if that is easier.

Lab (kind, unmanaged Calico Site with an Internal gateway pool, remote managed Site over GENEVE), on #943 at 8a2867a, fresh cluster per run:

Path	#943	#943 + this PR
remote pod -> gateway pod	FAIL	OK
gateway pod -> remote pod	FAIL	OK
remote pod -> member pod (via gateway)	FAIL	OK

Also checked with a two-gateway pool on #943 + this PR: remote pod <-> both gateway pods pass.

Not changed: health checks skip gateway peers without pod CIDRs (peer_healthcheck.go), so an unmanaged gateway is not health-checked or failed over. I have a follow-up for that and will send it once this lands.

Part of #921.

Testing: TestGatewayPeerReadyForTunnel, TestUpdateWireGuardFromSlices_UnmanagedSiteGatewayWithoutPodCIDRIsTunnelReady; go test ./cmd/unbounded-net-node/ ./internal/net/netlink/ ./internal/net/controller/ on Linux; golangci-lint on the changed packages; lab runs above.

[Semen Kolesnikov (Lotarcc)]

@microsoft-github-policy-service agree company="MODUS X LLC"

Semen Kolesnikov (Semen Kolesnikov (@Lotarcc)) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

[Semen Kolesnikov (Lotarcc)]

Patrick W. Healy (@phealy) Cameron Childress (@cchildress) could one of you approve the workflow runs for this and #930 / #931? They are
from a fork, so CI is waiting for approval.

The three PRs come from running Unbounded on AKS with Azure CNI pod subnets and an on-prem Flex
node (#921): #926 stops podCIDR assignment for manageCniPlugin: false Sites and lets remote nodes
use such gateways, #930 fixes dropped replies for traffic from the gateway's own Site, and #931
(stacked on #926) health-checks these gateways through the tunnel. Each was reproduced on main and
verified in a kind lab before opening.

I see #914-#918 rework the same area; happy to rebase onto them or adjust if you prefer a
different approach.

[Patrick W. Healy (phealy)]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Reviewed head 579b1f3ab89577eebca98bfeb3bf0f3c8bc0ea40 in the context of #943. Good to merge as a focused gateway-programming fix: the new gate preserves managed-Site startup behavior, admits unmanaged gateways with routed CIDRs, and includes the new flag in differential reconciliation.

Nonblocking limitations:

• PodCIDR-less gateways still skip health-check registration, so health-check-driven failover remains the explicitly documented follow-up: peer_healthcheck.go:113-117.
• The regression test captures peers through a mocked WireGuard configuration and calls the readiness/prefix helpers directly; it does not exercise shared-tunnel BPF programming: main_update_test.go:892-924.

One wording correction for eventual integration with #943: unmanaged Sites do not necessarily lack PodCIDRs, because explicit assignmentEnabled=true or an external allocator can provide them. The implementation already handles that case correctly; only the “never gets a podCIDR” comments are too absolute.

Leaving this PR separate for the author/user to merge; no cherry-pick or rebase performed.

[Patrick W. Healy (phealy)]

Still need to deal with health checks of gateway pool nodes that don't have a podCIDR