Skip to content

Commit 197bf0d

Browse files
vladcristidranicu
vladcristi
and
dranicu
authored
Nsgs feature (#421)
* added skip vcn and subnet functionality without nsg skip * webhook for nsg feature * webhook verifications, reconcilitation for nsgs and service gateway and conversions * added checks for igw, sgw, ngw and rt * conversion beta1-beta2 changes * added documentation for new feature * minor changes * comments to explain code * changes according to suggestions * adding comments and changes for more clarity * added e2e test for nsg-feature * changes in documents and comments for more clarity * changes according to PR review * changed from E4 shape to E5 to prevent issues during e2e --------- Co-authored-by: dranicu <[email protected]> Co-authored-by: Dragos Nicu <[email protected]>
1 parent efef113 commit 197bf0d

21 files changed

+558
-3
lines changed

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,7 @@ generate-e2e-templates: $(KUSTOMIZE)
297297
$(KUSTOMIZE) build $(OCI_TEMPLATES)/v1beta2/cluster-template-managed-self-managed-nodes --load-restrictor LoadRestrictionsNone > $(OCI_TEMPLATES)/v1beta2/cluster-template-managed-self-managed-nodes.yaml
298298
$(KUSTOMIZE) build $(OCI_TEMPLATES)/v1beta2/cluster-template-machine-with-ipv6 --load-restrictor LoadRestrictionsNone > $(OCI_TEMPLATES)/v1beta2/cluster-template-machine-with-ipv6.yaml
299299
$(KUSTOMIZE) build $(OCI_TEMPLATES)/v1beta2/cluster-template-with-paravirt-bv --load-restrictor LoadRestrictionsNone > $(OCI_TEMPLATES)/v1beta2/cluster-template-with-paravirt-bv.yaml
300+
$(KUSTOMIZE) build $(OCI_TEMPLATES)/v1beta2/cluster-template-self-manage-nsg --load-restrictor LoadRestrictionsNone > $(OCI_TEMPLATES)/v1beta2/cluster-template-self-manage-nsg.yaml
300301

301302
.PHONY: test-e2e-run
302303
test-e2e-run: generate-e2e-templates $(GINKGO) $(ENVSUBST) ## Run e2e tests

‎api/v1beta1/types.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -854,6 +854,10 @@ type Subnet struct {
854854
ID *string `json:"id,omitempty"`
855855
// Subnet Name.
856856
Name string `json:"name"`
857+
// Skip specifies whether to skip creating subnets. If set to true (default: false) the ID
858+
// must be specified by the user to a valid Subnet ID.
859+
// +optional
860+
Skip bool `json:"skip,omitempty"`
857861
// Subnet CIDR.
858862
// +optional
859863
CIDR string `json:"cidr,omitempty"`
@@ -906,6 +910,12 @@ type VCN struct {
906910
// +optional
907911
Name string `json:"name"`
908912

913+
// Skip specifies whether to skip creating VCN.
914+
// When is set to true, InternetGateway, NatGateway, ServiceGateway, RouteTable must have also Skip set to true
915+
// If set to true(default: false) the ID must be specified by the user to a valid VCN ID.
916+
// +optional
917+
Skip bool `json:"skip,omitempty"`
918+
909919
// VCN CIDR.
910920
// +optional
911921
// Deprecated, please use NetworkDetails.cidrs

‎api/v1beta1/zz_generated.conversion.go‎

Lines changed: 4 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/ocicluster_webhook.go‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,57 @@ func (c *OCICluster) ValidateCreate() (admission.Warnings, error) {
9494
}
9595
}
9696

97+
// If Skip field is true, ID field of VCN should be specified
98+
if c.Spec.NetworkSpec.Vcn.Skip == *common.Bool(true) {
99+
if c.Spec.NetworkSpec.Vcn.ID == common.String("") || c.Spec.NetworkSpec.Vcn.ID == nil {
100+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.ID"), c.Spec.NetworkSpec.Vcn.ID, "field is required"))
101+
}
102+
103+
// If Skip field is True, Skip field of InternetGateway should be true
104+
if c.Spec.NetworkSpec.Vcn.InternetGateway.Skip != *common.Bool(true) {
105+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.InternetGateway.Skip"), c.Spec.NetworkSpec.Vcn.InternetGateway.Skip, "field requires to be true when VCN is skipped"))
106+
}
107+
108+
// If Skip field is True, Skip field of ServiceGateway should be true
109+
if c.Spec.NetworkSpec.Vcn.ServiceGateway.Skip != *common.Bool(true) {
110+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.ServiceGateway.Skip"), c.Spec.NetworkSpec.Vcn.ServiceGateway.Skip, "field requires to be true when VCN is skipped"))
111+
}
112+
113+
// If Skip field is True, Skip field of NATGateway should be true
114+
if c.Spec.NetworkSpec.Vcn.NATGateway.Skip != *common.Bool(true) {
115+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.NATGateway.Skip"), c.Spec.NetworkSpec.Vcn.NATGateway.Skip, "field requires to be true when VCN is skipped"))
116+
}
117+
118+
// If Skip field is True, Skip field of RouteTable should be true
119+
if c.Spec.NetworkSpec.Vcn.RouteTable.Skip != *common.Bool(true) {
120+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.RouteTable.Skip"), c.Spec.NetworkSpec.Vcn.RouteTable.Skip, "field requires to be true when VCN is skipped"))
121+
}
122+
123+
// For each subnet
124+
for _, subnet := range c.Spec.NetworkSpec.Vcn.Subnets {
125+
126+
// if Skip field is true, ID field of Subnet should also be specified
127+
if subnet.Skip == *common.Bool(true) {
128+
if subnet.ID == common.String("") || subnet.ID == nil {
129+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "subnet.ID"), subnet.ID, "field is required"))
130+
}
131+
}
132+
// if ID field is specified, Skip field of Subnet should also be true
133+
if subnet.ID != common.String("") {
134+
if subnet.Skip != *common.Bool(true) {
135+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "subnet.Skip"), subnet.Skip, "field requires to be true if Subnet ID is specified"))
136+
}
137+
}
138+
}
139+
} else {
140+
// If Skip field of VCN is false, for each subnet in that VCN the Skip field of Subnet cannot be true
141+
for _, subnet := range c.Spec.NetworkSpec.Vcn.Subnets {
142+
if subnet.Skip == *common.Bool(true) {
143+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "subnet.Skip"), subnet.Skip, "field cannot be true when VCN is not skipped"))
144+
}
145+
}
146+
}
147+
97148
allErrs = append(allErrs, c.validate(nil)...)
98149

99150
if len(allErrs) == 0 {
@@ -133,6 +184,57 @@ func (c *OCICluster) ValidateUpdate(old runtime.Object) (admission.Warnings, err
133184
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "compartmentId"), c.Spec.CompartmentId, "field is immutable"))
134185
}
135186

187+
// If Skip field is true, ID field of VCN should be specified
188+
if c.Spec.NetworkSpec.Vcn.Skip == *common.Bool(true) {
189+
if c.Spec.NetworkSpec.Vcn.ID == common.String("") || c.Spec.NetworkSpec.Vcn.ID == nil {
190+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.ID"), c.Spec.NetworkSpec.Vcn.ID, "field is required"))
191+
}
192+
193+
// If Skip field is True, Skip field of InternetGateway should be true
194+
if c.Spec.NetworkSpec.Vcn.InternetGateway.Skip != *common.Bool(true) {
195+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.InternetGateway.Skip"), c.Spec.NetworkSpec.Vcn.InternetGateway.Skip, "field requires to be true when VCN is skipped"))
196+
}
197+
198+
// If Skip field is True, Skip field of ServiceGateway should be true
199+
if c.Spec.NetworkSpec.Vcn.ServiceGateway.Skip != *common.Bool(true) {
200+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.ServiceGateway.Skip"), c.Spec.NetworkSpec.Vcn.ServiceGateway.Skip, "field requires to be true when VCN is skipped"))
201+
}
202+
203+
// If Skip field is True, Skip field of NATGateway should be true
204+
if c.Spec.NetworkSpec.Vcn.NATGateway.Skip != *common.Bool(true) {
205+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.NATGateway.Skip"), c.Spec.NetworkSpec.Vcn.NATGateway.Skip, "field requires to be true when VCN is skipped"))
206+
}
207+
208+
// If Skip field is True, Skip field of RouteTable should be true
209+
if c.Spec.NetworkSpec.Vcn.RouteTable.Skip != *common.Bool(true) {
210+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "NetworkSpec.Vcn.RouteTable.Skip"), c.Spec.NetworkSpec.Vcn.RouteTable.Skip, "field requires to be true when VCN is skipped"))
211+
}
212+
213+
// For each subnet
214+
for _, subnet := range c.Spec.NetworkSpec.Vcn.Subnets {
215+
216+
// if Skip field is true, ID field of Subnet should also be specified
217+
if subnet.Skip == *common.Bool(true) {
218+
if subnet.ID == common.String("") || subnet.ID == nil {
219+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "subnet.ID"), subnet.ID, "field is required"))
220+
}
221+
}
222+
// if ID field is specified, Skip field of Subnet should also be true
223+
if subnet.ID != common.String("") {
224+
if subnet.Skip != *common.Bool(true) {
225+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "subnet.Skip"), subnet.Skip, "field requires to be true if Subnet ID is specified"))
226+
}
227+
}
228+
}
229+
} else {
230+
// If Skip field of VCN is false, for each subnet in that VCN the Skip field of Subnet cannot be true
231+
for _, subnet := range c.Spec.NetworkSpec.Vcn.Subnets {
232+
if subnet.Skip == *common.Bool(true) {
233+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "subnet.Skip"), subnet.Skip, "field cannot be true when VCN is not skipped"))
234+
}
235+
}
236+
}
237+
136238
allErrs = append(allErrs, c.validate(oldCluster)...)
137239

138240
if len(allErrs) == 0 {

‎api/v1beta2/types.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -854,6 +854,10 @@ type Subnet struct {
854854
ID *string `json:"id,omitempty"`
855855
// Subnet Name.
856856
Name string `json:"name"`
857+
// Skip specifies whether to skip creating subnets. If set to true(default: false) the ID
858+
// must be specified by the user to a valid Subnet ID.
859+
// +optional
860+
Skip bool `json:"skip,omitempty"`
857861
// Subnet CIDR.
858862
// +optional
859863
CIDR string `json:"cidr,omitempty"`
@@ -906,6 +910,12 @@ type VCN struct {
906910
// +optional
907911
Name string `json:"name"`
908912

913+
// Skip specifies whether to skip creating VCN.
914+
// When is set to true, InternetGateway, NatGateway, ServiceGateway, RouteTable must have also Skip set to true
915+
// If set to true(default: false) the ID must be specified by the user to a valid VCN ID.
916+
// +optional
917+
Skip bool `json:"skip,omitempty"`
918+
909919
// VCN CIDR.
910920
// +optional
911921
// Deprecated, please use NetworkDetails.cidrs
@@ -1125,6 +1135,7 @@ type RemotePeeringConnection struct {
11251135
// InternetGateway is used to specify the options for creating internet gateway.
11261136
type InternetGateway struct {
11271137
// Skip specifies whether to skip creating internet gateway even if any one Subnet is public.
1138+
// In case of VCN being Skipped (Skip field of VCN set to true), this field must be true also
11281139
// +optional
11291140
Skip bool `json:"skip,omitempty"`
11301141

@@ -1136,6 +1147,7 @@ type InternetGateway struct {
11361147
// NATGateway is used to specify the options for creating NAT gateway.
11371148
type NATGateway struct {
11381149
// Skip specifies whether to skip creating NAT gateway even if any one Subnet is private.
1150+
// In case of VCN being Skipped (Skip field of VCN set to true), this field must be true also
11391151
// +optional
11401152
Skip bool `json:"skip,omitempty"`
11411153

@@ -1147,6 +1159,7 @@ type NATGateway struct {
11471159
// ServiceGateway is used to specify the options for creating Service gateway.
11481160
type ServiceGateway struct {
11491161
// Skip specifies whether to skip creating Service gateway.
1162+
// In case of VCN being Skipped (Skip field of VCN set to true), this field must be true also
11501163
// +optional
11511164
Skip bool `json:"skip,omitempty"`
11521165

@@ -1158,6 +1171,7 @@ type ServiceGateway struct {
11581171
// RouteTable is used to specify the options for creating Route table.
11591172
type RouteTable struct {
11601173
// Skip specifies whether to skip creating Route table.
1174+
// In case of VCN being Skipped (Skip field of VCN set to true), this field must be true also
11611175
// +optional
11621176
Skip bool `json:"skip,omitempty"`
11631177

‎cloud/scope/nsg_reconciler.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ import (
3030
)
3131

3232
func (s *ClusterScope) ReconcileNSG(ctx context.Context) error {
33+
if s.OCIClusterAccessor.GetNetworkSpec().Vcn.NetworkSecurityGroup.Skip {
34+
s.Logger.Info("Skipping Network Security Group reconciliation as per spec")
35+
return nil
36+
}
3337
desiredNSGs := s.OCIClusterAccessor.GetNetworkSpec().Vcn.NetworkSecurityGroup
3438
for _, desiredNSG := range desiredNSGs.List {
3539
nsg, err := s.GetNSG(ctx, *desiredNSG)
@@ -124,6 +128,10 @@ func (s *ClusterScope) GetNSG(ctx context.Context, spec infrastructurev1beta2.NS
124128
}
125129

126130
func (s *ClusterScope) DeleteNSGs(ctx context.Context) error {
131+
if s.OCIClusterAccessor.GetNetworkSpec().Vcn.NetworkSecurityGroup.Skip {
132+
s.Logger.Info("Skipping Network Security Group reconciliation as per spec")
133+
return nil
134+
}
127135
desiredNSGs := s.OCIClusterAccessor.GetNetworkSpec().Vcn.NetworkSecurityGroup
128136
for _, desiredNSG := range desiredNSGs.List {
129137
nsg, err := s.GetNSG(ctx, *desiredNSG)

‎cloud/scope/service_gateway_reconciler.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ import (
2727
)
2828

2929
func (s *ClusterScope) ReconcileServiceGateway(ctx context.Context) error {
30+
if s.OCIClusterAccessor.GetNetworkSpec().Vcn.ServiceGateway.Skip {
31+
s.Logger.Info("Skipping Service Gateway reconciliation as per spec")
32+
return nil
33+
}
3034
if s.IsAllSubnetsPublic() {
3135
s.Logger.Info("All subnets are public, we don't need service gateway")
3236
return nil
@@ -86,6 +90,10 @@ func (s *ClusterScope) CreateServiceGateway(ctx context.Context) (*string, error
8690
}
8791

8892
func (s *ClusterScope) DeleteServiceGateway(ctx context.Context) error {
93+
if s.OCIClusterAccessor.GetNetworkSpec().Vcn.ServiceGateway.Skip {
94+
s.Logger.Info("Skipping Service Gateway reconciliation as per spec")
95+
return nil
96+
}
8997
sgw, err := s.GetServiceGateway(ctx)
9098
if err != nil && !ociutil.IsNotFound(err) {
9199
return err

‎cloud/scope/subnet_reconciler.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ import (
3232
func (s *ClusterScope) ReconcileSubnet(ctx context.Context) error {
3333
desiredSubnets := s.OCIClusterAccessor.GetNetworkSpec().Vcn.Subnets
3434
for _, desiredSubnet := range desiredSubnets {
35+
if desiredSubnet.Skip {
36+
s.Logger.Info("Skipping Subnet reconciliation as per spec")
37+
continue
38+
}
3539
subnet, err := s.GetSubnet(ctx, *desiredSubnet)
3640
if err != nil {
3741
return err
@@ -188,6 +192,10 @@ func (s *ClusterScope) UpdateSubnet(ctx context.Context, spec infrastructurev1be
188192
func (s *ClusterScope) DeleteSubnets(ctx context.Context) error {
189193
desiredSubnets := s.GetSubnetsSpec()
190194
for _, desiredSubnet := range desiredSubnets {
195+
if desiredSubnet.Skip {
196+
s.Logger.Info("Skipping Subnet reconciliation as per spec")
197+
continue
198+
}
191199
subnet, err := s.GetSubnet(ctx, *desiredSubnet)
192200
if err != nil && !ociutil.IsNotFound(err) {
193201
return err

‎cloud/scope/vcn_reconciler.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ import (
2828
)
2929

3030
func (s *ClusterScope) ReconcileVCN(ctx context.Context) error {
31+
if s.OCIClusterAccessor.GetNetworkSpec().Vcn.Skip {
32+
s.Logger.Info("Skipping VCN reconciliation as per spec")
33+
return nil
34+
}
3135
spec := s.OCIClusterAccessor.GetNetworkSpec().Vcn
3236

3337
var err error
@@ -150,6 +154,10 @@ func (s *ClusterScope) CreateVCN(ctx context.Context, spec infrastructurev1beta2
150154
}
151155

152156
func (s *ClusterScope) DeleteVCN(ctx context.Context) error {
157+
if s.OCIClusterAccessor.GetNetworkSpec().Vcn.Skip {
158+
s.Logger.Info("Skipping VCN reconciliation as per spec")
159+
return nil
160+
}
153161
vcn, err := s.GetVCN(ctx)
154162

155163
if err != nil && !ociutil.IsNotFound(err) {

‎config/crd/bases/infrastructure.cluster.x-k8s.io_ociclusters.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,9 @@ spec:
186186
id:
187187
description: VCN OCID.
188188
type: string
189+
skip:
190+
description: Skip specifies whether to skip creating vcn
191+
type: boolean
189192
internetGatewayId:
190193
description: ID of Internet Gateway.
191194
type: string
@@ -600,6 +603,9 @@ spec:
600603
id:
601604
description: Subnet OCID.
602605
type: string
606+
skip:
607+
description: Skip specifies whether to skip creating subnet
608+
type: boolean
603609
name:
604610
description: Subnet Name.
605611
type: string
@@ -1408,6 +1414,9 @@ spec:
14081414
id:
14091415
description: VCN OCID.
14101416
type: string
1417+
skip:
1418+
description: Skip specifies whether to skip creating vcn
1419+
type: boolean
14111420
internetGateway:
14121421
description: Configuration for Internet Gateway.
14131422
properties:
@@ -1881,6 +1890,9 @@ spec:
18811890
id:
18821891
description: Subnet OCID.
18831892
type: string
1893+
skip:
1894+
description: Skip specifies whether to skip creating subnet
1895+
type: boolean
18841896
name:
18851897
description: Subnet Name.
18861898
type: string

0 commit comments

Comments
 (0)