u/MegaMotyl

My Japanese ISP provides native IPv6 while carrying IPv4 through a mechanism selected by its own discovery protocol. That protocol uses the ISP DNS resolver to locate a provisioning service, which then returns the IPv4 over IPv6 mechanism and its endpoint. On my connection it selected DS-Lite.

I implemented the discovery protocol and a DS-Lite tunnel daemon in Rust, then connected my OmniOS host to the ISP supplied modem, with no router in between. The tunnel worked, but the final test exposed another part of the IPv6 access model. The ISP delegated a /56 through DHCPv6 prefix delegation, while stock illumos DHCP client requested only a host address and could not manage the delegated prefix.

I wrote about the implementation, Japanese ISP provisioning, and the direct connection experiment.

My team manages PAM entitlements through infrastructure as code, so it's easy to bootstrap a new project with a standard set of entitlements and rules for what services will be deployed and which groups will use the project. The number of entitlements keeps growing and discoverability is becoming a slight problem.

The web console has made some recent improvements, but users often run into a frustrating pattern where they visit a resource before their PAM grant is fully activated and hit a stale permission state that requires a hard refresh to resolve. For users who prefer the gcloud CLI the commands exist, but they usually require multiple steps.

I started experimenting with a smoother terminal interface (https://github.com/michalskalski/gpam), though the API gets in the way a bit. SearchEntitlements and SearchGrants both require specifying a parent resource, which forces iterating through multiple scopes and aggregating the results on the client side.

Is anyone building on top of the PAM API, and have you found workable patterns for cross-scope entitlement discovery, or for efficiently finding pending approvals?

Connecting an illumos server to a Japanese IPv6 service

Do you use PAM in your organization?