On demand deep merge

[DanPartelly]

Is pre_transform a good place to do a deep merge , or will it come and bite me back ? I do not want to have a separate ipsec plugin and induce dependencies for tunnel plugins, so a deep merge with a small upport API in _ipsec.py might do the job

def pre_transform(topology: Box):
  vti_dir = Path(__file__).resolve().parent
  ipsec_path = vti_dir.parent / "defaults.ipsec.yml"
  ipsec_box = read.read_yaml(str(ipsec_path))
  if ipsec_box is not None:
    topology.merge_update(ipsec_box)
  else:
    log.error(
      f"Cannot load defaults.ipsec.yml.",
      category=log.MissingDependency,
      module="tunnel.vti",
    )

[CoderDeltaLAN]

I’d be a little wary of doing it there. pre_transform is fine for derived topology data, but it’s late for defaults, and topology.merge_update(ipsec_box) would let that file overwrite user values. I’d keep _ipsec.py for the shared helper, but load the common YAML through the normal plugin-default path instead

[ipspace]

Is pre_transform a good place to do a deep merge

No. Rely on system defaults doing their job. Also, there's the question of settings precedence.

I do not want to have a separate ipsec plugin and induce dependencies for tunnel plugins, so a deep merge with a small upport API in _ipsec.py might do the job

I have no idea how firewalls do IPsec stuff, but most networking vendors realized (the hard way) that people use IPsec to build private networks, and that routing matters, so they eventually gave up crazy ideas like crypto maps and settled on IPsec tunnels.

So you'll need an IPsec tunnel plugin anyway, and you could have IPsec defaults defined there.