Add encapsulation flag to IPsecConfig struct

Signed-off-by: Michael Cambria <[email protected]> Signed-off-by: Periyasamy Palanisamy <[email protected]>
openshift · Nov 6, 2024 · 870a601 · 870a601
1 parent dfe4d9f
commit 870a601
Show file tree

Hide file tree

Showing 12 changed files with 75 additions and 1 deletion.
diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go
diff --git a/openapi/openapi.json b/openapi/openapi.json
@@ -27949,6 +27949,10 @@
     "com.github.openshift.api.operator.v1.IPsecConfig": {
       "type": "object",
       "properties": {
+        "encapsulation": {
+          "description": "encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets This is applicable only when mode is set to Full. Default is false.",
+          "type": "boolean"
+        },
         "mode": {
           "description": "mode defines the behaviour of the ipsec configuration within the platform. Valid values are `Disabled`, `External` and `Full`. When 'Disabled', ipsec will not be enabled at the node level. When 'External', ipsec is enabled on the node level but requires the user to configure the secure communication parameters. This mode is for external secure communications and the configuration can be done using the k8s-nmstate operator. When 'Full', ipsec is configured on the node level and inter-pod secure communication within the cluster is configured. Note with `Full`, if ipsec is desired for communication with external (to the cluster) entities (such as storage arrays), this is left to the user to configure.",
           "type": "string"

diff --git a/operator/v1/types_network.go b/operator/v1/types_network.go
@@ -562,6 +562,12 @@ type IPsecConfig struct {
 	// +kubebuilder:validation:Enum=Disabled;External;Full
 	// +optional
 	Mode IPsecMode `json:"mode,omitempty"`
+	// encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets
+	// This is applicable only when mode is set to Full.
+	// Default is false.
+	// +optional
+	// +kubebuilder:default:=false
+	Encapsulation bool `json:"encapsulation,omitempty"`
 }
 
 type IPForwardingMode string

diff --git a/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-CustomNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-CustomNoUpgrade.crd.yaml
@@ -412,6 +412,13 @@ spec:
                           ipsecConfig enables and configures IPsec for pods on the pod network within the
                           cluster.
                         properties:
+                          encapsulation:
+                            default: false
+                            description: |-
+                              encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets
+                              This is applicable only when mode is set to Full.
+                              Default is false.
+                            type: boolean
                           mode:
                             description: |-
                               mode defines the behaviour of the ipsec configuration within the platform.

diff --git a/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-Default.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_70_network_01_networks-Default.crd.yaml
@@ -379,6 +379,13 @@ spec:
                           ipsecConfig enables and configures IPsec for pods on the pod network within the
                           cluster.
                         properties:
+                          encapsulation:
+                            default: false
+                            description: |-
+                              encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets
+                              This is applicable only when mode is set to Full.
+                              Default is false.
+                            type: boolean
                           mode:
                             description: |-
                               mode defines the behaviour of the ipsec configuration within the platform.

diff --git a/...or/v1/zz_generated.crd-manifests/0000_70_network_01_networks-DevPreviewNoUpgrade.crd.yaml b/...or/v1/zz_generated.crd-manifests/0000_70_network_01_networks-DevPreviewNoUpgrade.crd.yaml
@@ -412,6 +412,13 @@ spec:
                           ipsecConfig enables and configures IPsec for pods on the pod network within the
                           cluster.
                         properties:
+                          encapsulation:
+                            default: false
+                            description: |-
+                              encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets
+                              This is applicable only when mode is set to Full.
+                              Default is false.
+                            type: boolean
                           mode:
                             description: |-
                               mode defines the behaviour of the ipsec configuration within the platform.

diff --git a/...r/v1/zz_generated.crd-manifests/0000_70_network_01_networks-TechPreviewNoUpgrade.crd.yaml b/...r/v1/zz_generated.crd-manifests/0000_70_network_01_networks-TechPreviewNoUpgrade.crd.yaml
@@ -412,6 +412,13 @@ spec:
                           ipsecConfig enables and configures IPsec for pods on the pod network within the
                           cluster.
                         properties:
+                          encapsulation:
+                            default: false
+                            description: |-
+                              encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets
+                              This is applicable only when mode is set to Full.
+                              Default is false.
+                            type: boolean
                           mode:
                             description: |-
                               mode defines the behaviour of the ipsec configuration within the platform.

diff --git a/...1/zz_generated.featuregated-crd-manifests/networks.operator.openshift.io/AAA_ungated.yaml b/...1/zz_generated.featuregated-crd-manifests/networks.operator.openshift.io/AAA_ungated.yaml
@@ -379,6 +379,13 @@ spec:
                           ipsecConfig enables and configures IPsec for pods on the pod network within the
                           cluster.
                         properties:
+                          encapsulation:
+                            default: false
+                            description: |-
+                              encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets
+                              This is applicable only when mode is set to Full.
+                              Default is false.
+                            type: boolean
                           mode:
                             description: |-
                               mode defines the behaviour of the ipsec configuration within the platform.

diff --git a/...turegated-crd-manifests/networks.operator.openshift.io/AdditionalRoutingCapabilities.yaml b/...turegated-crd-manifests/networks.operator.openshift.io/AdditionalRoutingCapabilities.yaml
@@ -412,6 +412,13 @@ spec:
                           ipsecConfig enables and configures IPsec for pods on the pod network within the
                           cluster.
                         properties:
+                          encapsulation:
+                            default: false
+                            description: |-
+                              encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets
+                              This is applicable only when mode is set to Full.
+                              Default is false.
+                            type: boolean
                           mode:
                             description: |-
                               mode defines the behaviour of the ipsec configuration within the platform.

diff --git a/...rated.featuregated-crd-manifests/networks.operator.openshift.io/NetworkLiveMigration.yaml b/...rated.featuregated-crd-manifests/networks.operator.openshift.io/NetworkLiveMigration.yaml
@@ -379,6 +379,13 @@ spec:
                           ipsecConfig enables and configures IPsec for pods on the pod network within the
                           cluster.
                         properties:
+                          encapsulation:
+                            default: false
+                            description: |-
+                              encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets
+                              This is applicable only when mode is set to Full.
+                              Default is false.
+                            type: boolean
                           mode:
                             description: |-
                               mode defines the behaviour of the ipsec configuration within the platform.

diff --git a/...erated.featuregated-crd-manifests/networks.operator.openshift.io/RouteAdvertisements.yaml b/...erated.featuregated-crd-manifests/networks.operator.openshift.io/RouteAdvertisements.yaml
@@ -379,6 +379,13 @@ spec:
                           ipsecConfig enables and configures IPsec for pods on the pod network within the
                           cluster.
                         properties:
+                          encapsulation:
+                            default: false
+                            description: |-
+                              encapsulation uses rfc3949 encapsulation of IKE and IPsec encryption packets
+                              This is applicable only when mode is set to Full.
+                              Default is false.
+                            type: boolean
                           mode:
                             description: |-
                               mode defines the behaviour of the ipsec configuration within the platform.

diff --git a/operator/v1/zz_generated.swagger_doc_generated.go b/operator/v1/zz_generated.swagger_doc_generated.go