Merge branch 'main' into add-network-device-credentials-config

Author: khackworth

components/openstack-sync-operator/crds/neutron.understack.rackspace.net_neutronsegmentranges.yaml

@@ -0,0 +1,218 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: neutronsegmentranges.neutron.understack.rackspace.net
+spec:
+  group: neutron.understack.rackspace.net
+  names:
+    kind: NeutronSegmentRange
+    listKind: NeutronSegmentRangeList
+    plural: neutronsegmentranges
+    shortNames:
+    - nsr
+    singular: neutronsegmentrange
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true
+    additionalPrinterColumns:
+    - name: Name
+      type: string
+      jsonPath: .spec.name
+    - name: Type
+      type: string
+      jsonPath: .spec.network_type
+    - name: Physical
+      type: string
+      jsonPath: .spec.physical_network
+    - name: Min
+      type: integer
+      jsonPath: .spec.minimum
+    - name: Max
+      type: integer
+      jsonPath: .spec.maximum
+    - name: Shared
+      type: boolean
+      jsonPath: .spec.shared
+    - name: SyncStatus
+      type: string
+      jsonPath: .status.syncStatus
+    - name: Age
+      type: date
+      jsonPath: .metadata.creationTimestamp
+    schema:
+      openAPIV3Schema:
+        description: >-
+          NeutronSegmentRange defines one Neutron network segment range
+          (``openstack network segment range``). The operator finds or creates
+          the operator-owned range identified by ``spec.name`` and reconciles
+          its minimum/maximum segmentation IDs toward the spec. Creating a CR
+          claims ownership of a range the operator creates under an ownership
+          prefix; a range created out-of-band is not adopted. Neutron only
+          allows updating minimum and maximum on an existing range, so a CR
+          that disagrees on network_type, physical_network, shared or
+          project_id fails loudly rather than silently diverging.
+        type: object
+        required:
+        - spec
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            type: object
+            required:
+            - name
+            - network_type
+            - minimum
+            - maximum
+            - cloudCredentialsRef
+            properties:
+              cloudCredentialsRef:
+                description: >-
+                  cloudCredentialsRef points to a Kubernetes Secret containing
+                  an OpenStack clouds.yaml file. The operator reads this secret
+                  directly at reconcile time; no volume mount is required.
+                type: object
+                required:
+                - secretName
+                - cloudName
+                properties:
+                  secretName:
+                    description: >-
+                      Name of a Secret in the same namespace as this resource.
+                      The Secret must contain a key named clouds.yaml holding
+                      an OpenStack clouds.yaml file.
+                    type: string
+                    minLength: 1
+                    maxLength: 253
+                  cloudName:
+                    description: >-
+                      Name of the cloud entry within the clouds.yaml to
+                      authenticate as.
+                    type: string
+                    minLength: 1
+                    maxLength: 256
+              name:
+                description: >-
+                  Neutron network segment range name. This is the identity the
+                  operator uses to find, create, and prune the range, so
+                  it must be unique per cloud. The operator prepends a 14-char
+                  ownership prefix (``understack-sr:``) before storing the name
+                  in Neutron, whose name column holds 255 chars, so the logical
+                  name is capped at 241.
+                type: string
+                minLength: 1
+                maxLength: 241
+                pattern: ^[A-Za-z0-9._/-]+$
+              network_type:
+                description: >-
+                  The network type of the segment range. VLAN IDs apply to the
+                  ``vlan`` type; tunnel IDs apply to ``geneve``, ``gre`` and
+                  ``vxlan``.
+                type: string
+                enum:
+                - vlan
+                - vxlan
+                - gre
+                - geneve
+                minLength: 1
+                maxLength: 32
+              physical_network:
+                description: >-
+                  The physical network the segment range is bound to. Required
+                  for ``vlan`` ranges and must be omitted for the tunnelled
+                  types (``vxlan``, ``gre``, ``geneve``); the operator enforces
+                  this at reconcile time. Neutron stores this in a 64-char
+                  column.
+                type: string
+                minLength: 1
+                maxLength: 64
+              minimum:
+                description: >-
+                  The minimum segmentation ID in the range (inclusive). Must be
+                  less than or equal to ``maximum``.
+                type: integer
+                format: int64
+                minimum: 1
+              maximum:
+                description: >-
+                  The maximum segmentation ID in the range (inclusive). Must be
+                  greater than or equal to ``minimum``.
+                type: integer
+                format: int64
+                minimum: 1
+              shared:
+                description: >-
+                  Whether the segment range is shared with all projects. When
+                  false the range is scoped to ``project_id``, which then
+                  becomes required.
+                type: boolean
+                default: true
+              project_id:
+                description: >-
+                  The project the range is scoped to when ``shared`` is false.
+                  Ignored for shared ranges.
+                type: string
+                minLength: 1
+                maxLength: 255
+            x-kubernetes-validations:
+            - rule: self.maximum >= self.minimum
+              message: maximum must be greater than or equal to minimum
+            - rule: "self.shared || has(self.project_id)"
+              message: project_id is required when shared is false
+          status:
+            description: NeutronSegmentRangeStatus defines the observed sync state.
+            type: object
+            properties:
+              syncStatus:
+                description: SyncStatus indicates the synchronization state with Neutron.
+                type: string
+                enum:
+                - Synced
+                - Failed
+                - Unknown
+              lastSyncTime:
+                description: LastSyncTime is the last time the operator attempted to sync the range.
+                type: string
+                format: date-time
+              observedGeneration:
+                description: ObservedGeneration is the metadata generation last processed by the operator.
+                type: integer
+                format: int64
+              message:
+                description: Message provides details about the last sync attempt.
+                type: string
+                maxLength: 2048
+              conditions:
+                description: Conditions describe current observed state.
+                type: array
+                items:
+                  type: object
+                  required:
+                  - type
+                  - status
+                  properties:
+                    type:
+                      type: string
+                    status:
+                      type: string
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                    reason:
+                      type: string
+                    message:
+                      type: string
+                      maxLength: 2048
+                    lastTransitionTime:
+                      type: string
+                      format: date-time
+    subresources:
+      status: {}

components/openstack-sync-operator/values.yaml

@@ -32,6 +32,7 @@ plugins:
   neutronRouterFlavors: false
   neutronSubnetPools: false
   ironicRunbooks: false
+  neutronSegmentRanges: false
 
 pluginData:
   openstackPlaceholder:
@@ -83,3 +84,19 @@ pluginData:
         # When true, removing an IronicRunbook CR also deletes its
         # operator-owned Ironic runbook. Enable this before removing the CR.
         PRUNE: false
+
+  neutronSegmentRanges:
+    hook:
+      path: /hooks/segment_ranges.py
+      crd: crds/neutron.understack.rackspace.net_neutronsegmentranges.yaml
+      envPrefix: NEUTRON_SEGMENT_RANGE
+      env:
+        SYNC_CRONTAB: "0 * * * *"
+        # Neutron readiness wait before a segment range reconcile fails.
+        # Total wait is READY_RETRIES * READY_DELAY seconds.
+        READY_RETRIES: 30
+        READY_DELAY: 10
+        # When true, removing a NeutronSegmentRange CR also deletes its
+        # operator-managed OpenStack segment range. Enable this before
+        # removing the CR.
+        PRUNE: false

containers/openstack-sync-operator/Dockerfile

@@ -20,3 +20,4 @@ COPY --chmod=755 python/openstack-sync/openstack_sync/hooks/placeholder.py /hook
 COPY --chmod=755 python/openstack-sync/openstack_sync/hooks/router_flavors.py /hooks/router_flavors.py
 COPY --chmod=755 python/openstack-sync/openstack_sync/hooks/subnet_pools.py /hooks/subnet_pools.py
 COPY --chmod=755 python/openstack-sync/openstack_sync/hooks/ironic_runbooks.py /hooks/ironic_runbooks.py
+COPY --chmod=755 python/openstack-sync/openstack_sync/hooks/segment_ranges.py /hooks/segment_ranges.py

python/openstack-sync/openstack_sync/hooks/segment_ranges.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Shell-operator hook for Neutron network segment range reconciliation."""
+
+from __future__ import annotations
+
+import sys
+from typing import Any
+
+from openstack_sync.hooks.framework import HookConfig
+from openstack_sync.hooks.framework import ReconcileResult
+from openstack_sync.hooks.framework import SyncPlugin
+from openstack_sync.hooks.framework import build_crd_hook_config
+from openstack_sync.hooks.framework import hook_enabled
+from openstack_sync.hooks.framework import hook_inputs
+from openstack_sync.hooks.framework import run_hook
+from openstack_sync.hooks.framework import run_sync
+from openstack_sync.plugins.common import wait_for_openstack_network
+from openstack_sync.plugins.neutron.segment_ranges import prune as prune_module
+from openstack_sync.plugins.neutron.segment_ranges import reconcile as reconcile_module
+from openstack_sync.plugins.neutron.segment_ranges.config import BINDING_NAME
+from openstack_sync.plugins.neutron.segment_ranges.config import ENV_PREFIX
+
+
+class SegmentRangePlugin(SyncPlugin):
+    """Sync NeutronSegmentRange CRs into Neutron network segment ranges."""
+
+    noun = "segment range"
+
+    def wait_for_api(self, conn: Any) -> None:
+        wait_for_openstack_network(
+            conn,
+            retries=self.config.ready_retries,
+            delay=self.config.ready_delay,
+        )
+
+    def new_cache(self) -> reconcile_module.RangeCache:
+        # Keyed by managed range name and shared across every CR in one
+        # credential group, so the managed-range listing is fetched once and
+        # reused by each reconcile in the group. Prune does not receive this
+        # cache (SyncPlugin.prune / PruneRequest carry no cache) and re-lists
+        # from Neutron itself.
+        return {}
+
+    def reconcile(
+        self, conn: Any, spec: dict[str, Any], cache: reconcile_module.RangeCache
+    ) -> ReconcileResult:
+        notes = reconcile_module.sync_segment_range(conn, spec, cache)
+        return ReconcileResult(notes=notes)
+
+    def prune(
+        self,
+        conn: Any,
+        desired_specs: list[dict[str, Any]],
+        *,
+        authoritative_empty: bool,
+    ) -> None:
+        # The framework only calls prune under a cleanup policy that runs it,
+        # which for this plugin means the chart's PRUNE flag is enabled (see
+        # SyncPlugin.cleanup_policy: config.prune + a real prune step ->
+        # FINALIZED_PRUNE). No manual gate on config.prune is needed here.
+        prune_module.prune_removed_ranges(
+            conn, desired_specs, authoritative_empty=authoritative_empty
+        )
+
+
+def main() -> int:
+    def run(contexts: list[dict[str, Any]]) -> int:
+        if not hook_enabled(ENV_PREFIX):
+            return 0
+        config = HookConfig.from_env(ENV_PREFIX, binding_name=BINDING_NAME)
+        return run_sync(SegmentRangePlugin(config), hook_inputs(contexts, config))
+
+    return run_hook(lambda: build_crd_hook_config(ENV_PREFIX, BINDING_NAME), run)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

python/openstack-sync/openstack_sync/plugins/neutron/segment_ranges/__init__.py

@@ -0,0 +1 @@
+"""Neutron network segment range sync plugin."""

python/openstack-sync/openstack_sync/plugins/neutron/segment_ranges/config.py

@@ -0,0 +1,22 @@
+"""Segment-range plugin constants.
+
+Runtime configuration comes from
+:class:`openstack_sync.hooks.framework.HookConfig`, built from the
+``NEUTRON_SEGMENT_RANGE`` env prefix the Helm chart injects. The values here are
+not configurable at runtime.
+"""
+
+from __future__ import annotations
+
+#: Env prefix the Helm chart uses for this plugin's variables.
+ENV_PREFIX = "NEUTRON_SEGMENT_RANGE"
+
+#: shell-operator binding label for the CRD watch.
+BINDING_NAME = "neutron-segment-ranges"
+
+#: Network types Neutron binds to a physical network. VLAN ranges require
+#: ``physical_network``; the tunnelled types must omit it.
+PHYSICAL_NETWORK_TYPES = frozenset({"vlan"})
+
+#: Network types carried over a tunnel, which must not set ``physical_network``.
+TUNNEL_NETWORK_TYPES = frozenset({"vxlan", "gre", "geneve"})