✨ RosaNetwork: new CRD & reconciler to provision network infrastructure for ROSA-HCP #5464

mzazrivec · 2025-04-09T19:27:34Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

This pull request implements CRD and a controller for provisioning complete networking infrastructure required to install a ROSA-HCP cluster in AWS. The proposal for this implementation has been described in #5381.

Under the hood, the implementation uses cloudformation stack and a static (i.e. no possibility of customization) cloudformation template from (rosa-cli)[https://github.com/openshift/rosa/blob/master/cmd/create/network/templates/rosa-quickstart-default-vpc/cloudformation.yaml].

This pull request depends on openshift/rosa#2904

Quick howto:

$ export ROSA_NETWORK_NAME=rosa-net-01
$ export AWS_REGION=us-west-2
$ export AVAILABILITY_ZONE_COUNT=2
$ export CIDR_BLOCK=10.0.0.0/16
$ clusterctl generate yaml --from templates/rosa-network.yaml > rosa-net-01.yaml
$ kubectl apply -f rosa-net-01.yaml

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

Release note:

k8s-ci-robot · 2025-04-09T19:27:36Z

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2025-04-09T19:27:43Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andidog for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-04-09T19:27:44Z

Hi @mzazrivec. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

serngawy · 2025-04-10T14:39:00Z

config/crd/patches/webhook_in_rosanetworks.yaml

+    webhookClientConfig:
+      # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
+      # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
+      caBundle: Cg==


No need to add the caBundle.

serngawy · 2025-04-10T14:45:18Z

exp/api/v1beta2/rosanetwork_types.go

+	Resource string `json:"resource"`
+
+	// Identified of the created resource. Will be filled in once the resource is created & ready
+	ID string `json:"ID"`


Suggested change

ID string `json:"ID"`

Id string `json:"id"`

Or resourceId

serngawy · 2025-04-10T14:46:01Z

exp/api/v1beta2/rosanetwork_types.go

+// CFResource groups information pertaining to a resource created as a part of a cloudformation stack
+type CFResource struct {
+	// Name of the created resource: NATGateway1, VPC, SecurityGroup, ...
+	Resource string `json:"resource"`


Suggested change

Resource string `json:"resource"`

Name string `json:"name"`

OR resourceName

serngawy · 2025-04-10T14:49:19Z

exp/api/v1beta2/rosanetwork_types.go

+	Status string `json:"status"`
+
+	// Message pertaining to the status of the resource
+	Reason string `json:"reason"`


message is better I guess ?

Suggested change

Reason string `json:"reason"`

Message string `json:"message"`

serngawy · 2025-04-10T14:51:37Z

exp/api/v1beta2/rosanetwork_types.go

+	// Availability zone of the subnet pair
+	AvailabilityZone string `json:"availabilityZone"`
+
+	// ID of the public subnet


Suggested change

// ID of the public subnet

// Public subnet Id ex; subnet-xxxxxxxxxx

serngawy · 2025-04-10T14:53:59Z

main.go

@@ -284,6 +284,15 @@ func main() {
 		}
 	}

+	// TODO: feature gates?


I don't think we need a new feature gate, we can have it under ROSA feature gate

Yes. I did not mean a new feature gate here, just the existing rosa FG.

serngawy · 2025-04-23T11:46:57Z

you also need to update the ValidatingWebhookConfiguration and MutatingWebhookConfiguration here

serngawy

/ok-to-test

serngawy · 2025-04-24T13:43:59Z

exp/api/v1beta2/rosanetwork_types.go

+	// If no identity is specified, the default identity for this controller will be used.
+	//
+	// +optional
+	IdentityRef *infrav1.AWSIdentityReference `json:"identityRef,omitempty"`


Not sure, if we want to provide this option to end user. We don't do that with RosaControlPlane only default aws identity. However, we should provide OCM identityRef

Why shouldn't we provide this option to the end user? We need to specify the ref to the aws secret somehow. Here I'm just reusing existing structures & code.

What do you mean by OCM identity ref? OCM will not be involved here in any way.

well, to use openshift/rosa and establish ocm client you need to have ocm authentication. Is this not the case with the RosaNetwork CF stack creation?

No. No OCM credentials are needed for rosanet, just AWS credentials.

marek-veber · 2025-07-14T13:02:40Z

config/crd/kustomization.yaml

@@ -38,6 +39,7 @@ patchesStrategicMerge:
 - patches/webhook_in_awsmanagedcontrolplanes.yaml
 - patches/webhook_in_eksconfigs.yaml
 - patches/webhook_in_eksconfigtemplates.yaml
+#- patches/webhook_in_rosanetworks.yaml


The conversion webhook wil not be implemented?

marek-veber · 2025-07-14T13:03:42Z

config/crd/kustomization.yaml

@@ -52,6 +54,7 @@ patchesStrategicMerge:
 - patches/cainjection_in_awsmanagedclusters.yaml
 - patches/cainjection_in_eksconfigs.yaml
 - patches/cainjection_in_eksconfigtemplates.yaml
+#- patches/cainjection_in_rosanetworks.yaml


This line should be uncommented, is't it?

Yep, uncommented. Thanks.

mzazrivec · 2025-07-15T12:30:03Z

you also need to update the ValidatingWebhookConfiguration and MutatingWebhookConfiguration here

Is that really needed at this point? (there are no webhooks implemented for rosanet yet).

k8s-ci-robot · 2025-07-18T12:48:00Z

@mzazrivec: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-provider-aws-build	`e7f18ec`	link	true	`/test pull-cluster-api-provider-aws-build`
pull-cluster-api-provider-aws-test	`e7f18ec`	link	true	`/test pull-cluster-api-provider-aws-test`
pull-cluster-api-provider-aws-verify	`e7f18ec`	link	true	`/test pull-cluster-api-provider-aws-verify`
pull-cluster-api-provider-aws-build-docker	`e7f18ec`	link	true	`/test pull-cluster-api-provider-aws-build-docker`
pull-cluster-api-provider-aws-e2e-blocking	`e7f18ec`	link	true	`/test pull-cluster-api-provider-aws-e2e-blocking`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

k8s-ci-robot requested review from faiq and serngawy April 9, 2025 19:27

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Apr 9, 2025

mzazrivec force-pushed the rosa_network branch from 3435873 to 22dea0b Compare April 9, 2025 19:32

serngawy reviewed Apr 10, 2025

View reviewed changes

mzazrivec force-pushed the rosa_network branch 4 times, most recently from 5907fb1 to 24a5950 Compare April 24, 2025 13:20

mzazrivec force-pushed the rosa_network branch 3 times, most recently from a947563 to a255790 Compare May 19, 2025 13:43

mzazrivec force-pushed the rosa_network branch from a255790 to d923d6f Compare May 28, 2025 12:17

serngawy reviewed May 28, 2025

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 28, 2025

mzazrivec force-pushed the rosa_network branch 4 times, most recently from d2534a7 to dcc599d Compare June 9, 2025 08:19

mzazrivec force-pushed the rosa_network branch 3 times, most recently from 6f09844 to 241e957 Compare July 2, 2025 14:55

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 2, 2025

mzazrivec force-pushed the rosa_network branch 4 times, most recently from 277c2c9 to f101821 Compare July 9, 2025 13:22

mzazrivec force-pushed the rosa_network branch 6 times, most recently from 56c9d7a to 32a5181 Compare July 11, 2025 12:36

mzazrivec mentioned this pull request Jul 11, 2025

📖 Proposal for ROSA networking #5381

Open

5 tasks

marek-veber reviewed Jul 14, 2025

View reviewed changes

mzazrivec force-pushed the rosa_network branch from 32a5181 to 9ec3c17 Compare July 14, 2025 14:01

marek-veber reviewed Jul 14, 2025

View reviewed changes

mzazrivec changed the title ~~WIP RosaNetwork~~ ✨ RosaNetwork Jul 15, 2025

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 15, 2025

mzazrivec changed the title ~~✨ RosaNetwork~~ ✨ RosaNetwork: new CRD & reconciler to provision net infra for ROSA-HCP Jul 15, 2025

mzazrivec changed the title ~~✨ RosaNetwork: new CRD & reconciler to provision net infra for ROSA-HCP~~ ✨ RosaNetwork: new CRD & reconciler to provision network infrastructure for ROSA-HCP Jul 15, 2025

mzazrivec force-pushed the rosa_network branch from 9ec3c17 to 7456f86 Compare July 15, 2025 12:28

mzazrivec force-pushed the rosa_network branch from c21fbb3 to 97bd409 Compare July 16, 2025 21:06

mzazrivec added 2 commits July 18, 2025 14:41

RosaNetwork: new CRD & reconciler to provision net infra for ROSA-HCP

3b0895f

ROSAControlPlane to use net info from RosaNetwork CR

e7f18ec

mzazrivec force-pushed the rosa_network branch from 97bd409 to e7f18ec Compare July 18, 2025 12:42

	Reason string `json:"reason"`
	Message string `json:"message"`

	// ID of the public subnet
	// Public subnet Id ex; subnet-xxxxxxxxxx

✨ RosaNetwork: new CRD & reconciler to provision network infrastructure for ROSA-HCP #5464

Are you sure you want to change the base?

✨ RosaNetwork: new CRD & reconciler to provision network infrastructure for ROSA-HCP #5464

Conversation

mzazrivec commented Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Apr 9, 2025

Uh oh!

k8s-ci-robot commented Apr 9, 2025

Uh oh!

k8s-ci-robot commented Apr 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

serngawy commented Apr 23, 2025

Uh oh!

serngawy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mzazrivec commented Jul 15, 2025

Uh oh!

k8s-ci-robot commented Jul 18, 2025

Uh oh!

Uh oh!

mzazrivec commented Apr 9, 2025 •

edited

Loading