VNet (epic)

[ravicious]

After Q2, we will balance customer feedback (supporting multiple ports) with expanding to new platforms (Windows, Linux, HTTP apps, etc)

Q3

Preview Give feedback

1. Multi-port TCP app access #46758
   8 of 9
   epic +1
   

Post Q3

Preview Give feedback

1. VNet Windows support #50849
   c-asd vnet windows +3
   
2. Linux support
3. HTTP apps
4. Create marketing tab for VNet in Connect #39507
   vnet +1
5. Run a set of heuristics during VNet launch to let users self-debug issues #43232
   0 of 1
   vnet +1

Tech debt to address

Preview Give feedback

1. Rotate VNet logs #45407
   vnet +1
2. We should respect the priority of ordered nameservers in /etc/resolv.conf and add a short delay for each one down the list
3. Support --bootstrap for vnet_config resources
4. Add vnet_config to the cache
5. add a default vnet_config so tctl edit vnet_config works OOTB
6. Steal focus in Connect after successfully installing VNet https://gravitational.slack.com/archives/C03FJA391M3/p1726124228362489?thread_ts=1726075850.091949&cid=C03FJA391M3
7. Handling expired certs if user didn't connect to app before cert expiry [vnet][3] DNS resolution #41031 (comment) [vnet][6] IPv4 support #41542 (comment)
8. VNet: support DNS over TCP #48859
   feature-request vnet +2

---

During Q2, we'll focus on getting rid of the repeated password prompt, supporting per-session MFA, and adding more feedback to the UI.

Q2 (Rafal)

Preview Give feedback

1. Add launch daemon plist for VNet #43746
   backport/branch/v16 no-changelog size/md ui +4
2. Add implementation of VNet daemon #43952
   backport/branch/v16 no-changelog rfd size/lg tsh +5
3. Detect SMAppService support, monitor daemon status
4. VNet daemon: Set code signing requirements #44639
   backport/branch/v16 no-changelog size/md +3
5. Per-session MFA
6. prevent multiple VNet processes from running simultaneously Improve handling of various lifecycle erorrs in VNet #41413 (comment)

---

At the start of Q2, we'll make the implementation more robust.

Early Q2 (aiming for 16.0) (Nic + Rafal)

Preview Give feedback

1. Reuse API clients (Nic) [vnet][5] app proxying #41033
2. Support multiple active profiles (Nic) [vnet][5] app proxying #41033
3. Support custom DNS zones (Nic) [vnet][7] custom DNS zones #41545
4. Add basic VNet integration to Connect #41415
   backport/branch/v16 no-changelog size/md tsh +4
5. Add telemetry to VNet in Connect #41587
   backport/branch/v16 no-changelog size/md tsh ui +5
6. Handle expired certs in VNet in Connect #41889
   backport/branch/v16 no-changelog size/md ui +4
7. Add end user docs for VNet #42550 Add custom DNS zone docs for VNet #42846
8. [vnet] leaf cluster support #42600
   backport/branch/v16 no-changelog size/md tsh vnet +5

---

By the end of Q1 we want to have a fully functional VNet integration in Connect and tsh. VNet itself won't be daemonized yet, so it will prompt for password on each start.

Q1

Preview Give feedback

1. Implement tsh vnet (without recent connections)
2. IPv6 support
3. Open VNet panel when launching TCP app from Connect #40526
   no-changelog size/md ui +3
4. Implement minor UI changes to account for VNet in Connect #39506
   vnet +1
5. [vnet][0] setup virtual netstack #40889
   no-changelog size/lg +2
6. [vnet][1] setup TUN and IPv6 on MacOS #40893
   no-changelog size/md tsh +3
7. [vnet][2] DNS library #40972
   no-changelog size/lg +2
8. [vnet][3] DNS resolution #41031
   no-changelog size/md tsh +3
9. [vnet][4] host DNS configuration #41032
   no-changelog size/md tsh +3
10. [vnet][5] app proxying #41033
    backport/branch/v16 machine-id no-changelog size/md tsh +5
11. [vnet][6] IPv4 support #41542
    backport/branch/v16 no-changelog size/md tsh +4
12. Add vnet_config resource
13. https://github.com/gravitational/cloud/pull/8092
14. Capture access_through in protocol use events in Connect #40995
    no-changelog size/sm ui +3

---

We want to provide the design partner with a demo ASAP. It won't have any of the niceties listed in the Q1 list and basically any UI. What's important is that it will let them verify whether the core idea of VNet.

Demo for the design partner

Preview Give feedback

1. Support custom DNS zones
2. Share the demo by March 29th