Add Network, NetworkLink, InterNetworkIngress, NetworkAccess CRD types and manifests

.gitignore

@@ -32,12 +32,16 @@ vendor/
 manifest.json
 oci-archives/
 skupper-cluster-scope.yaml
+skupper-crds.yaml
+skupper-multi-van-crds.yaml
 skupper-namespace-scope.yaml
 skupper-network-observer*.yaml
 bundle.Dockerfile
 ./bundle/
 !charts/skupper/README.md
 charts/skupper/
+charts/skupper-crds/templates/crds.yaml
+charts/skupper-crds/templates/multi-van-crds.yaml
 skupper-*.tgz
 artifacthub-repo.yml
 network-observer-*.tgz

Makefile

@@ -160,6 +160,9 @@ generate-docs: generate-doc
 generate-skupper-helm-chart:
 	./scripts/skupper-helm-chart-generator.sh ${IMAGE_TAG} ${ROUTER_IMAGE_TAG}
 
+generate-skupper-crds-helm-chart:
+	./scripts/skupper-crds-helm-chart-generator.sh ${IMAGE_TAG}
+
 generate-skupper-deployment-cluster-scoped:
 	./scripts/skupper-deployment-generator.sh cluster ${IMAGE_TAG} ${ROUTER_IMAGE_TAG} false > skupper-cluster-scope.yaml
 
@@ -168,10 +171,14 @@ generate-skupper-deployment-namespace-scoped:
 
 generate-crd-manifest:
 	kubectl kustomize config/crd > skupper-crds.yaml
+	kubectl kustomize config/crd/multi-van > skupper-multi-van-crds.yaml
 
 pack-skupper-helm-chart: generate-skupper-helm-chart
 	helm package ./charts/skupper
 
+pack-skupper-crds-helm-chart: generate-skupper-crds-helm-chart
+	helm package ./charts/skupper-crds
+
 pack-network-observer-helm-chart:
 	helm package ./charts/network-observer
 

charts/skupper-crds/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: skupper-crds
+description: Helm chart for installing and upgrading Skupper CRDs.
+version: 0.1.0-dev
+appVersion: v2-dev

charts/skupper-crds/README.md

@@ -0,0 +1,108 @@
+# skupper-crds
+
+Helm chart for installing and upgrading [Skupper](https://skupper.io) CRDs.
+
+Unlike the main `skupper` chart — where CRDs are placed in `crds/` and
+therefore only installed on the initial `helm install` — this chart places all
+CRDs in `templates/` so that `helm upgrade` applies the latest schemas on every
+run.
+
+## Prerequisites
+
+- Kubernetes 1.25+
+- Helm 3
+
+## Using the chart
+
+The chart exposes two independent flags that control which CRDs are installed:
+
+| Value | Default | Description |
+|---|---|---|
+| `base` | `true` | Install the stable Skupper CRDs. |
+| `multiVan` | `false` | Install the 4 multi-VAN CRDs (Network, NetworkLink, InterNetworkIngress, NetworkAccess). |
+
+### Base CRDs
+
+The stable Skupper CRDs are installed by default:
+
+```bash
+helm install skupper-crds oci://quay.io/skupper/helm/skupper-crds
+```
+
+To install only the multi-VAN CRDs and skip the base ones (e.g. base CRDs are
+already present in the cluster from a previous install):
+
+```bash
+helm install skupper-crds oci://quay.io/skupper/helm/skupper-crds \
+    --set base=false \
+    --set multiVan=true
+```
+
+### Multi-VAN CRDs
+
+The chart includes 4 additional CRDs that enable multi-VAN (Virtual Application
+Network) support: `Network`, `NetworkLink`, `InterNetworkIngress`, and
+`NetworkAccess`. These are **disabled by default** and must be opted in
+explicitly:
+
+```bash
+helm install skupper-crds oci://quay.io/skupper/helm/skupper-crds \
+    --set multiVan=true
+```
+
+To install both base and multi-VAN CRDs together using an override `values.yaml`:
+
+```yaml
+base: true
+multiVan: true
+```
+
+> **Note:** Once CRDs are installed, removing them (by running `helm upgrade`
+> with a flag set to `false`) will **delete** the CRDs from the cluster, if they
+> were installed via this helm chart.
+> If the CRDs were installed using a different mechanism, Helm will not delete
+> those CRDs during an upgrade or uninstall. If you want to delete them, you have
+> to do it manually, with `kubectl delete crd`.
+
+## Upgrading the chart
+
+Because all CRDs are in `templates/`, running `helm upgrade` is sufficient to
+apply any schema changes:
+
+```bash
+helm upgrade skupper-crds oci://quay.io/skupper/helm/skupper-crds
+```
+
+To also upgrade the multi-VAN CRDs:
+
+```bash
+helm upgrade skupper-crds oci://quay.io/skupper/helm/skupper-crds \
+    --set multiVan=true
+```
+
+## Development
+
+The chart has two parts:
+
+- **Static** — `Chart.yaml`, `values.yaml`, `README.md`, and
+  `templates/NOTES.txt` are committed to the repository.
+- **Generated** — `templates/crds.yaml` (stable CRDs, gated by `base`) and
+  `templates/multi-van-crds.yaml` (multi-van CRDs, gated by `multiVan`) are
+  produced by the generator script from the source files under `config/crd/`
+  and are gitignored. Both template files are applied on every `helm upgrade`
+  when their respective flag is `true`.
+
+To regenerate the chart before packaging or linting, run:
+
+```bash
+make generate-skupper-crds-helm-chart
+```
+
+This generates `templates/crds.yaml` from `config/crd/bases/` and
+`templates/multi-van-crds.yaml` from `config/crd/multi-van/`.
+
+To package the chart as a `.tgz`:
+
+```bash
+make pack-skupper-crds-helm-chart
+```

charts/skupper-crds/templates/NOTES.txt

@@ -0,0 +1,9 @@
+===========================================================
+  skupper-crds chart is now installed in the cluster.
+  Skupper CRDs are available cluster-wide.
+{{- if .Values.multiVan }}
+
+  Multi-VAN CRDs (Network, NetworkLink, InterNetworkIngress,
+  NetworkAccess) have been installed.
+{{- end }}
+===========================================================

charts/skupper-crds/values.yaml

@@ -0,0 +1,6 @@
+# When set to true, install the base CRDs
+base: true
+# When set to true, the 4 multi-VAN CRDs (Network, NetworkLink,
+# InterNetworkIngress, NetworkAccess) are installed/upgraded on every
+# helm install and helm upgrade. Set to false (the default) to omit them.
+multiVan: false

config/crd/bases/skupper_router_access_crd.yaml

@@ -162,6 +162,18 @@ spec:
                     - reason
                     - status
                     - type
+                roles:
+                  type: array
+                  description: |-
+                    List of roles and their allocated ports.
+                    If a role does not specify a port, the controller assigns a dynamic port and reports it here.
+                  items:
+                    type: object
+                    properties:
+                      name:
+                        type: string
+                      port:
+                        type: integer
                 endpoints:
                   type: array
                   description: |-

config/crd/kustomization.yaml

@@ -12,4 +12,4 @@ resources:
 - bases/skupper_multikeylistener_crd.yaml
 - bases/skupper_router_access_crd.yaml
 - bases/skupper_secured_access_crd.yaml
-- bases/skupper_site_crd.yaml
+- bases/skupper_site_crd.yaml

config/crd/multi-van/kustomization.yaml

@@ -0,0 +1,5 @@
+resources:
+- skupper_inter_network_ingress_crd.yaml
+- skupper_network_access_crd.yaml
+- skupper_network_crd.yaml
+- skupper_network_link_crd.yaml

config/crd/multi-van/skupper_inter_network_ingress_crd.yaml

@@ -0,0 +1,132 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: internetworkingresses.skupper.io
+spec:
+  group: skupper.io
+  versions:
+    - name: v2alpha1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          description: |-
+            An InterNetworkIngress can be defined alongside a NetworkLink or a NetworkAccess, exposing
+            a local ingress routing key to be used by the remote router through an inter-network
+            mTLS connection.
+            The remote router can only send messages to the provided routing key.
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                routingKey:
+                  type: string
+                  description: The local ingress key to be exposed through the inter-network connection.
+                networkLink:
+                  type: string
+                  description: Name of the NetworkLink to expose the routing key through.
+                networkAccess:
+                  type: string
+                  description: Name of the NetworkAccess to expose the routing key through.
+                settings:
+                  description: |-
+                    Advanced. A map containing additional settings. Each map
+                    entry has a string name and a string value.
+
+                    **Note:** In  general, we recommend not changing `settings`
+                    from their default values.
+                  type: object
+                  additionalProperties:
+                    type: string
+              x-kubernetes-validations:
+                - message: At least one of 'networkLink' or 'networkAccess' must be provided and non-empty.
+                  rule: (has(self.networkLink) && self.networkLink != "") || (has(self.networkAccess) && self.networkAccess != "")
+              required:
+                - routingKey
+            status:
+              type: object
+              properties:
+                status:
+                  description: |-
+                    The current state of the resource.
+                    - `Pending`: The resource is being processed.
+                    - `Error`: There was an error processing the resource. See `message` for more information.
+                    - `Ready`: The resource is ready to use.
+                  type: string
+                message:
+                  description: |-
+                    A human-readable status message. Error messages are reported here.
+                  type: string
+                conditions:
+                  type: array
+                  description: |-
+                    A set of named conditions describing the current state of the resource.
+
+                    - `Configured`: The inter network ingress configuration has been applied to the router.
+                    - `Ready`: Access to the exposed routing key is ready. All other conditions are true.
+                  items:
+                    type: object
+                    properties:
+                      lastTransitionTime:
+                        format: date-time
+                        type: string
+                      message:
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        enum:
+                        - "True"
+                        - "False"
+                        - Unknown
+                        type: string
+                      type:
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                    - lastTransitionTime
+                    - message
+                    - reason
+                    - status
+                    - type
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+      - name: Routing Key
+        type: string
+        description: The local ingress key
+        jsonPath: .spec.routingKey
+      - name: Network Link
+        type: string
+        description: The network link name to use
+        jsonPath: .spec.networkLink
+      - name: Network Access
+        type: string
+        description: The network access name to use
+        jsonPath: .spec.networkAccess
+      - name: Status
+        type: string
+        description: The status of the VAN site
+        jsonPath: .status.status
+      - name: Message
+        type: string
+        description: Any human readable message relevant to the site
+        jsonPath: .status.message
+  scope: Namespaced
+  names:
+    plural: internetworkingresses
+    singular: internetworkingress
+    kind: InterNetworkIngress
+    listKind: InterNetworkIngressList
+    shortNames:
+    - ini