add nxos support to match (ext-)communities on routingpolicy

Signed-off-by: Ivo Gosemann <ivo.gosemann@sap.com>

Author: IvoGoman

api/core/v1alpha1/groupversion_info.go

@@ -289,6 +289,10 @@ const (
 const (
 	// PrefixSetNotFoundReason indicates that a referenced PrefixSet was not found.
 	PrefixSetNotFoundReason = "PrefixSetNotFound"
+	// CommunitySetNotFoundReason indicates that a referenced CommunitySet was not found.
+	CommunitySetNotFoundReason = "CommunitySetNotFound"
+	// InvalidCommunitySetTypeReason indicates that a referenced CommunitySet is of the wrong type (standard vs extended).
+	InvalidCommunitySetTypeReason = "InvalidCommunitySetType"
 	// SecretNotFoundReason indicates that a referenced Secret was not found.
 	SecretNotFoundReason = "SecretNotFound"
 	// RemoteEndpointUnreachableReason indicates that the remote object storage endpoint is not reachable.

api/core/v1alpha1/routingpolicy_types.go

@@ -63,6 +63,14 @@ type PolicyConditions struct {
 	// MatchPrefixSet matches routes against a PrefixSet resource.
 	// +optional
 	MatchPrefixSet *PrefixSetMatchCondition `json:"matchPrefixSet,omitempty"`
+
+	// MatchCommunitySet matches routes against a CommunitySet resource.
+	// +optional
+	MatchCommunitySet *CommunitySetMatchCondition `json:"matchCommunitySet,omitempty"`
+
+	// MatchExtendedCommunitySet matches routes against a CommunitySet resource of type Extended.
+	// +optional
+	MatchExtendedCommunitySet *CommunitySetMatchCondition `json:"matchExtendedCommunitySet,omitempty"`
 }
 
 // PrefixSetMatchCondition defines the condition for matching against a PrefixSet.
@@ -73,6 +81,30 @@ type PrefixSetMatchCondition struct {
 	PrefixSetRef LocalObjectReference `json:"prefixSetRef"`
 }
 
+// CommunitySetMatchCondition defines the condition for matching against a CommunitySet.
+type CommunitySetMatchCondition struct {
+	// CommunitySetRef references a CommunitySet in the same namespace.
+	// The CommunitySet must exist and belong to the same device.
+	// +required
+	CommunitySetRef LocalObjectReference `json:"communitySetRef"`
+
+	// MatchSetOption defines if the route must match 'Any' or 'All' of the community members in the set.
+	// +optional
+	// +kubebuilder:default=Any
+	MatchSetOption MatchSetOption `json:"matchSetOption,omitempty"`
+}
+
+// MatchSetOption defines how a route's attributes are compared against a referenced set.
+// +kubebuilder:validation:Enum=Any;All
+type MatchSetOption string
+
+const (
+	// MatchSetOptionAny matches a route carrying at least one member of the referenced set.
+	MatchSetOptionAny MatchSetOption = "Any"
+	// MatchSetOptionAll matches only a route carrying every member of the referenced set.
+	MatchSetOptionAll MatchSetOption = "All"
+)
+
 // PolicyActions defines the actions to take when a policy statement matches.
 // +kubebuilder:validation:XValidation:rule="self.routeDisposition == 'AcceptRoute' || !has(self.bgpActions)",message="bgpActions cannot be specified when routeDisposition is RejectRoute"
 type PolicyActions struct {

api/core/v1alpha1/zz_generated.deepcopy.go

@@ -24,7 +24,7 @@ resources:
 # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
 - ../certmanager
 # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
-#- ../prometheus
+- ../prometheus
 # [METRICS] Expose the controller manager metrics service.
 - metrics_service.yaml
 # [PROVISIONING] Expose the controller manager provisioning service.

charts/network-operator/templates/crd/routingpolicies.networking.metal.ironcore.dev.yaml

@@ -72,6 +72,22 @@ spec:
         bgpActions:
           setASPath:
             asNumber: 65000
+    - sequence: 80
+      conditions:
+        matchCommunitySet:
+          communitySetRef:
+            name: communityset-regular
+          matchSetOptions: All
+      actions:
+        routeDisposition: AcceptRoute
+    - sequence: 90
+      conditions:
+        matchExtendedCommunitySet:
+          communitySetRef:
+            name: communityset-extended
+          matchSetOptions: All
+      actions:
+        routeDisposition: AcceptRoute
     - sequence: 100
       actions:
         routeDisposition: AcceptRoute
@@ -129,3 +145,39 @@ spec:
       maskLengthRange:
         min: 25
         max: 32
+---
+apiVersion: networking.metal.ironcore.dev/v1alpha1
+kind: CommunitySet
+metadata:
+  labels:
+    app.kubernetes.io/name: network-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: communityset-regular
+spec:
+  deviceRef:
+    name: leaf1
+  name: example-communityset
+  type: Standard
+  members:
+    - sequence: 5
+      regex: "50000:[0-9][0-9]"
+    - sequence: 10
+      regex: "65001:[0-9]+"
+---
+apiVersion: networking.metal.ironcore.dev/v1alpha1
+kind: CommunitySet
+metadata:
+  labels:
+    app.kubernetes.io/name: network-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: communityset-extended
+spec:
+  deviceRef:
+    name: leaf1
+  name: example-extcommunityset
+  type: Extended
+  members:
+    - sequence: 5
+      regex: "65200:[0-9][0-9]"
+    - sequence: 15
+      regex: "65300:[0-9]+"