Merge branch 'main' into feat/agentic-skills

Author: rgildein

.gitattributes

@@ -8,6 +8,7 @@
 
 # Images should be stored in Git LFS, and not have their line endings modified.
 *.png filter=lfs diff=lfs merge=lfs -text
+*.gif filter=lfs diff=lfs merge=lfs -text
 
 # Generated files — collapsed in PR diffs, excluded from language stats.
 api/**/zz_generated.deepcopy.go linguist-generated

.github/workflows/test-gnmi.yaml

@@ -28,6 +28,7 @@ jobs:
       matrix:
         provider:
           - openconfig
+          - cisco-nxos-gnmi
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7

AGENTS.md

@@ -96,6 +96,7 @@ kubectl --context <context> logs -n network-operator-system deployment/network-o
 ```
 
 - **Use** `metav1.Condition` for status (not custom string fields)
+- **Place enum validation on enum types**: Put `// +kubebuilder:validation:Enum=...` on named enum type definitions (for example, `type T string`), not on fields using those types
 - **Use predefined types**: `metav1.Time` instead of `string` for dates
 - **Follow K8s API conventions**: Standard field names (`spec`, `status`, `metadata`)
 
@@ -153,6 +154,13 @@ Using `omitempty` or `omitzero` JSON struct tags on gNMI payload structs is dang
 3. Diff compares device state (with defaults) against desired (without) → mismatch
 4. Operator performs a Set on every reconcile — breaking idempotency
 
+**`omitempty` guidelines:**
+
+1. **Safe:** The field's Go zero value matches the platform default or "absent" state. Omitting it from the payload is semantically equivalent to the device's default.
+2. **Safe:** The field is a pointer or slice representing "not configured" (nil) vs "configured" (non-nil). Mutually exclusive choices (e.g. `accept`/`drop`) fall into this category.
+3. **Dangerous:** The platform default is non-zero (e.g. `admin-state` defaults to `"enable"`, `port` defaults to `49`). Omitting the Go zero value would either misrepresent intent or cause a false diff on subsequent GET responses.
+4. **Unnecessary:** The field is unconditionally set to a non-zero value by the provider code. The tag never triggers, but removing it documents intent — the field is always present.
+
 **Rule:** After setting configuration once, the provider must produce no gNMI Set calls on subsequent reconciles when no user-facing configuration has changed. Test this explicitly.
 
 ## Logging

Makefile

@@ -48,14 +48,14 @@ help: ## Display this help.
 
 .PHONY: manifests
 manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
-	$(CONTROLLER_GEN) crd rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+	$(CONTROLLER_GEN) crd rbac:roleName=manager-role webhook paths="{./api/...,./internal/...}" output:crd:artifacts:config=config/crd/bases
 
 YEAR ?= $(shell date +%Y)
 
 .PHONY: generate
 generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
-	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt",year="$(YEAR)" paths="./..."
-	$(CONTROLLER_GEN) applyconfiguration:headerFile="hack/boilerplate.go.txt" paths="./..."
+	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt",year="$(YEAR)" paths="{./api/...,./internal/...}"
+	$(CONTROLLER_GEN) applyconfiguration:headerFile="hack/boilerplate.go.txt" paths="{./api/...,./internal/...}"
 
 .PHONY: fmt
 fmt: goimports gofumpt ## Run goimports and gofumpt against code.
@@ -106,8 +106,8 @@ PROVIDER ?= openconfig
 GINKGO_PROCS ?= $(shell nproc 2>/dev/null || sysctl -n hw.logicalcpu)
 
 .PHONY: test-gnmi
-test-gnmi: setup-envtest ## Run gNMI tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" PROVIDER=$(PROVIDER) go test ./test/gnmi/ -v -ginkgo.v
+test-gnmi: setup-envtest ginkgo ## Run gNMI tests.
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" PROVIDER=$(PROVIDER) $(GINKGO) --procs=$(GINKGO_PROCS) -v ./test/gnmi/
 
 .PHONY: test-lab
 test-lab: ## Run lab tests against a real network device.
@@ -181,6 +181,10 @@ run-docs:
 build: manifests generate fmt vet ## Build manager binary.
 	CGO_ENABLED=0 go build $(LDFLAGS) -o bin/manager cmd/main.go
 
+.PHONY: kubectl-net
+kubectl-net: ## Build kubectl-net plugin binary.
+	cd kubectl-net && CGO_ENABLED=0 go build -ldflags="-s -w -X 'main.version=$(VERSION)'" -o ../bin/kubectl-net .
+
 .PHONY: run
 run: manifests generate fmt vet ## Run a controller from your host.
 	go run ./cmd/main.go
@@ -270,6 +274,7 @@ GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
 GOLANGCI_LINT_CUSTOM = $(LOCALBIN)/golangci-lint-custom
 GOIMPORTS ?= $(LOCALBIN)/goimports
 GOFUMPT ?= $(LOCALBIN)/gofumpt
+GINKGO ?= $(LOCALBIN)/ginkgo
 ADDLICENSE ?= $(LOCALBIN)/addlicense
 GO_LICENSES ?= $(LOCALBIN)/go-licenses
 TYPOS ?= $(LOCALBIN)/typos
@@ -286,8 +291,9 @@ ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -
 KUBEBUILDER_VERSION ?= v4.15.0
 CRD_REF_DOCS_VERSION ?= v0.3.0
 GOLANGCI_LINT_VERSION ?= v2.12.2
-GOIMPORTS_VERSION ?= v0.48.0
+GOIMPORTS_VERSION ?= $(shell go list -m -f "{{ .Version }}" golang.org/x/tools)
 GOFUMPT_VERSION ?= v0.10.0
+GINKGO_VERSION ?= $(shell go list -m -f "{{ .Version }}" github.com/onsi/ginkgo/v2)
 ADDLICENSE_VERSION ?= v1.2.0
 GO_LICENSES_VERSION ?= v2.0.1
 TYPOS_VERSION ?= v1.48.0
@@ -347,6 +353,11 @@ gofumpt: $(GOFUMPT) ## Download gofumpt locally if necessary.
 $(GOFUMPT): $(LOCALBIN)
 	$(call go-install-tool,$(GOFUMPT),mvdan.cc/gofumpt,$(GOFUMPT_VERSION))
 
+.PHONY: ginkgo
+ginkgo: $(GINKGO) ## Download ginkgo locally if necessary.
+$(GINKGO): $(LOCALBIN)
+	$(call go-install-tool,$(GINKGO),github.com/onsi/ginkgo/v2/ginkgo,$(GINKGO_VERSION))
+
 .PHONY: addlicense
 addlicense: $(ADDLICENSE) ## Download addlicense locally if necessary.
 $(ADDLICENSE): $(LOCALBIN)
@@ -429,3 +440,7 @@ kind-delete: kind ## Destroys the kind cluster.
 .PHONY: tilt-up
 tilt-up: $(KUSTOMIZE) kind-create ## Start tilt and create the kind cluster if needed
 	tilt up --context kind-$(KIND_CLUSTER_NAME)
+
+.PHONY: tilt-debug-up
+tilt-debug-up: export DEBUG = true
+tilt-debug-up: tilt-up

PROJECT

@@ -73,6 +73,9 @@ resources:
   kind: AccessControlList
   path: github.com/ironcore-dev/network-operator/api/core/v1alpha1
   version: v1alpha1
+  webhooks:
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
@@ -403,4 +406,12 @@ resources:
   kind: Fabric
   path: github.com/ironcore-dev/network-operator/api/evpn/v1alpha1
   version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  controller: true
+  domain: networking.metal.ironcore.dev
+  kind: Probe
+  path: github.com/ironcore-dev/network-operator/api/core/v1alpha1
+  version: v1alpha1
 version: "3"

README.md

@@ -83,6 +83,17 @@ make uninstall
 make undeploy
 ```
 
+## kubectl Plugin
+
+The `kubectl-net` plugin extends kubectl with shorthand flags and resource lifecycle operations tailored to network-operator.
+
+```bash
+kubectl net get interfaces --device leaf1
+kubectl net pause devices leaf1 --recursive
+```
+
+See [kubectl-net/README.md](kubectl-net/README.md) for installation and full usage documentation.
+
 ## Project Distribution
 
 Following are the steps to build the installer and distribute this project to users.

Tiltfile

@@ -46,9 +46,16 @@ provider = os.getenv('PROVIDER', 'openconfig')
 manager = kustomize('config/develop')
 manager = str(manager).replace('--provider=openconfig', '--provider={}'.format(provider))
 
+debug = os.getenv('DEBUG', '') == 'true'
+if debug:
+    # Scale the in-cluster manager to 0 so it can be run locally in a debugger.
+    manager = str(manager).replace('replicas: 1', 'replicas: 0')
+
 k8s_yaml(blob(manager))
 k8s_resource('network-operator-controller-manager', resource_deps=['controller-gen'], labels=['operator'])
 
+k8s_resource('minio', port_forwards=['9001:9001'])
+
 # Sample resources with manual trigger mode
 def device_yaml():
     decoded = read_yaml_stream('./config/samples/v1alpha1_device.yaml')
@@ -57,7 +64,10 @@ def device_yaml():
         decoded[0]['spec']['endpoint']['address'] = ip+':9339'
     return encode_yaml_stream(decoded)
 
-k8s_yaml(device_yaml())
+if debug:
+  k8s_yaml('./config/samples/v1alpha1_device.yaml')
+else:
+  k8s_yaml(device_yaml())
 k8s_resource(new_name='leaf1', objects=['leaf1:device', 'secret-basic-auth:secret'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
 
 k8s_yaml('./config/samples/v1alpha1_interface.yaml')
@@ -116,6 +126,7 @@ k8s_resource(new_name='bgp-rdst', objects=['bgp-rdst:bgp'], resource_deps=['bgp-
 k8s_yaml('./config/samples/cisco/nx/v1alpha1_bgpconfig.yaml')
 k8s_resource(new_name='bgpconfig-adv-pip', objects=['bgpconfig-adv-pip:bgpconfig'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
 k8s_resource(new_name='bgpconfig-export-gw', objects=['bgpconfig-export-gw:bgpconfig'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
+k8s_resource(new_name='bgpconfig-adv-l2vpn-evpn', objects=['bgpconfig-adv-l2vpn-evpn:bgpconfig'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
 
 k8s_yaml('./config/samples/v1alpha1_bgppeer.yaml')
 k8s_resource(new_name='peer-spine1', objects=['leaf1-spine1:bgppeer'], resource_deps=['bgp', 'lo0'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
@@ -171,6 +182,7 @@ k8s_resource(new_name='aaa', objects=['aaa-tacacs:aaa', 'tacacs-server-keys:secr
 k8s_yaml('./config/samples/v1alpha1_configbackup.yaml')
 k8s_resource(new_name='local-backup', objects=['local-backup:configbackup'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
 k8s_resource(new_name='startup-backup', objects=['startup-backup:configbackup'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
+k8s_resource(new_name='remote-backup', objects=['remote-backup:configbackup', 'minio-credentials:secret', 'backup-encryption-key:secret'], resource_deps=['minio'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
 
 k8s_yaml('./config/samples/v1alpha1_indexpool.yaml')
 k8s_resource(new_name='indexpool', objects=['indexpool-sample:indexpool'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
@@ -189,6 +201,12 @@ k8s_resource(new_name='claim-prefix', objects=['claim-prefix:claim'], resource_d
 k8s_yaml('./config/samples/v1alpha1_fabric.yaml')
 k8s_resource(new_name='fabric', objects=['fabric:fabric', 'loopback-pool:ipaddresspool', 'underlay-p2p-pool:ipprefixpool'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
 
+k8s_yaml('./config/samples/v1alpha1_probe.yaml')
+k8s_resource(new_name='ping-peer', objects=['ping-peer:probe'], resource_deps=['lo0'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
+k8s_resource(new_name='mac-entry', objects=['mac-entry:probe'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
+k8s_resource(new_name='route-prefix', objects=['route-prefix:probe'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
+k8s_resource(new_name='vtep-peers', objects=['vtep-peers:probe'], trigger_mode=TRIGGER_MODE_MANUAL, auto_init=False, labels=['samples'])
+
 print('🚀 network-operator development environment')
 print('👉 Edit the code inside the api/, cmd/, or internal/ directories')
 print('👉 Tilt will automatically rebuild and redeploy when changes are detected')

api/cisco/nx/v1alpha1/bgpconfig_types.go

@@ -34,6 +34,26 @@ type BGPConfigAddressFamilies struct {
 	Ipv6Unicast *BGPConfigUnicastAddressFamily `json:"ipv6Unicast,omitempty"`
 }
 
+// Ipv4UnicastExportGatewayIP reports whether export gateway IP is enabled for the IPv4 unicast address family.
+func (af *BGPConfigAddressFamilies) Ipv4UnicastExportGatewayIP() bool {
+	return af != nil && af.Ipv4Unicast != nil && af.Ipv4Unicast.ExportGatewayIP != nil && *af.Ipv4Unicast.ExportGatewayIP
+}
+
+// Ipv6UnicastExportGatewayIP reports whether export gateway IP is enabled for the IPv6 unicast address family.
+func (af *BGPConfigAddressFamilies) Ipv6UnicastExportGatewayIP() bool {
+	return af != nil && af.Ipv6Unicast != nil && af.Ipv6Unicast.ExportGatewayIP != nil && *af.Ipv6Unicast.ExportGatewayIP
+}
+
+// Ipv4UnicastAdvertiseL2vpnEvpn reports whether advertise l2vpn evpn is enabled for the IPv4 unicast address family.
+func (af *BGPConfigAddressFamilies) Ipv4UnicastAdvertiseL2vpnEvpn() bool {
+	return af != nil && af.Ipv4Unicast != nil && af.Ipv4Unicast.AdvertiseL2vpnEvpn != nil && *af.Ipv4Unicast.AdvertiseL2vpnEvpn
+}
+
+// Ipv6UnicastAdvertiseL2vpnEvpn reports whether advertise l2vpn evpn is enabled for the IPv6 unicast address family.
+func (af *BGPConfigAddressFamilies) Ipv6UnicastAdvertiseL2vpnEvpn() bool {
+	return af != nil && af.Ipv6Unicast != nil && af.Ipv6Unicast.AdvertiseL2vpnEvpn != nil && *af.Ipv6Unicast.AdvertiseL2vpnEvpn
+}
+
 // BGPL2vpnEvpn defines the configuration for L2VPN EVPN address family.
 type BGPL2vpnEvpn struct {
 	// AdvertisePIP controls whether the BGP EVPN address-family should advertise the primary IP address (PIP) as the next-hop
@@ -50,6 +70,12 @@ type BGPConfigUnicastAddressFamily struct {
 	// required for symmetric IRB in VXLAN BGP EVPN topologies.
 	// +optional
 	ExportGatewayIP *bool `json:"exportGatewayIP,omitempty"`
+
+	// AdvertiseL2vpnEvpn enables advertising EVPN routes within the VRF
+	// unicast address family. Required on border gateway nodes for cross-site
+	// EVPN Type-5 IP prefix route advertisement.
+	// +optional
+	AdvertiseL2vpnEvpn *bool `json:"advertiseL2vpnEvpn,omitempty"`
 }
 
 // +kubebuilder:object:root=true

api/cisco/nx/v1alpha1/nveconfig_types.go

@@ -27,6 +27,8 @@ type NetworkVirtualizationEdgeConfigSpec struct {
 	HoldDownTime int16 `json:"holdDownTime,omitempty"`
 
 	// InfraVLANs specifies VLANs used by all SVI interfaces for uplink and vPC peer-links in VXLAN as infra-VLANs.
+	// Valid VLAN IDs are 1-4092 because NX-OS always reserves VLANs 4093-4095 for internal use.
+	// The provider also checks these VLANs against the device's configurable internal reserved VLAN range.
 	// The total number of VLANs configured must not exceed 512.
 	// Elements in the list must not overlap with each other.
 	// +optional
@@ -42,15 +44,15 @@ type NetworkVirtualizationEdgeConfigSpec struct {
 type VLANListItem struct {
 	// +optional
 	// +kubebuilder:validation:Minimum=1
-	// +kubebuilder:validation:Maximum=3967
+	// +kubebuilder:validation:Maximum=4092
 	ID int16 `json:"id,omitempty"`
 	// +optional
 	// +kubebuilder:validation:Minimum=1
-	// +kubebuilder:validation:Maximum=3967
+	// +kubebuilder:validation:Maximum=4092
 	RangeMin int16 `json:"rangeMin,omitempty"`
 	// +optional
 	// +kubebuilder:validation:Minimum=1
-	// +kubebuilder:validation:Maximum=3967
+	// +kubebuilder:validation:Maximum=4092
 	RangeMax int16 `json:"rangeMax,omitempty"`
 }