Skip to content

Add Network, NetworkLink, InterNetworkIngress, NetworkAccess CRD types and manifests #2541

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fgiorgetti wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Add Network, NetworkLink, InterNetworkIngress, NetworkAccess CRD types and manifests #2541

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2b809a8
Add Network, NetworkLink, InterNetworkIngress, NetworkAccess CRD type…
fgiorgetti Jul 21, 2026
7ed9545
ADR explaining multi-van context and decisions
fgiorgetti Jul 28, 2026
2debd55
Fixed CEL validation and removed dup code as suggeseted by CodeRabbit
fgiorgetti Jul 30, 2026
12b25f2
Fixed RelesaedUnusedPorts
fgiorgetti Jul 30, 2026
330be09
Added unit tests to modified CRD related Go types
fgiorgetti Jul 30, 2026
2139175
Fixed conditions description for new CRDs
fgiorgetti Jul 30, 2026
f9d22df
Fixed typo in crd validation rule
fgiorgetti Jul 30, 2026
cbccb35
Introduced helm chart for skupper-crds
fgiorgetti Jul 30, 2026
1c9762c
Keep multi-van resources as part of RBAC
fgiorgetti Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
134 changes: 134 additions & 0 deletions config/crd/bases/skupper_inter_network_ingress_crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,134 @@
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: internetworkingresses.skupper.io
spec:
group: skupper.io
versions:
- name: v2alpha1
served: true
storage: true
schema:
openAPIV3Schema:
description: |-
An InterNetworkIngress can be defined alongside a NetworkLink or a NetworkAccess, exposing
a local ingress routing key to be used by the remote router through an inter-network
mTLS connection.
The remote router can only send messages to the provided routing key.
type: object
properties:
spec:
type: object
properties:
routingKey:
type: string
description: The local ingress key to be exposed through the inter-network connection.
networkLink:
type: string
description: Name of the NetworkLink to expose the routing key through.
networkAccess:
type: string
description: Name of the NetworkAccess to expose the routing key through.
settings:
description: |-
Advanced. A map containing additional settings. Each map
entry has a string name and a string value.

**Note:** In general, we recommend not changing `settings`
from their default values.
type: object
additionalProperties:
type: string
x-kubernetes-validations:
- message: At least one of 'networkLink' or 'networkAccess' must be provided and non-empty.
rule: (has(self.networkLink) && self.networkLink != ”) || (has(self.networkAccess) && self.networkAccess != ”)
Comment thread
fgiorgetti marked this conversation as resolved.
Outdated
required:
- routingKey
status:
type: object
properties:
status:
description: |-
The current state of the resource.
- `Pending`: The resource is being processed.
- `Error`: There was an error processing the resource. See `message` for more information.
- `Ready`: The resource is ready to use.
type: string
message:
description: |-
A human-readable status message. Error messages are reported here.
type: string
conditions:
type: array
description: |-
A set of named conditions describing the current state of the resource.

- `Configured`: The output resources for this resource have been created.
- `Running`: There is at least one router pod running.
- `Resolved`: The hostname or IP address for link access is available.
- `Ready`: The site is ready for use. All other conditions are true.
Comment thread
fgiorgetti marked this conversation as resolved.
Outdated
items:
type: object
properties:
lastTransitionTime:
format: date-time
type: string
message:
maxLength: 32768
type: string
observedGeneration:
format: int64
minimum: 0
type: integer
reason:
maxLength: 1024
minLength: 1
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
type: string
status:
enum:
- "True"
- "False"
- Unknown
type: string
type:
maxLength: 316
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
type: string
required:
- lastTransitionTime
- message
- reason
- status
- type
subresources:
status: {}
additionalPrinterColumns:
- name: Routing Key
type: string
description: The local ingress key
jsonPath: .spec.routingKey
- name: Network Link
type: string
description: The network link name to use
jsonPath: .spec.networkLink
- name: Network Access
type: string
description: The network access name to use
jsonPath: .spec.networkAccess
- name: Status
type: string
description: The status of the VAN site
jsonPath: .status.status
- name: Message
type: string
description: Any human readable message relevant to the site
jsonPath: .status.message
scope: Namespaced
names:
plural: internetworkingresses
singular: internetworkingress
kind: InterNetworkIngress
listKind: InterNetworkIngressList
shortNames:
- ini
186 changes: 186 additions & 0 deletions config/crd/bases/skupper_network_access_crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,186 @@
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: networkaccesses.skupper.io
spec:
group: skupper.io
versions:
- name: v2alpha1
served: true
storage: true
schema:
openAPIV3Schema:
description: |-
Configuration for secure access to the site router for inter-network communication.
The configuration includes TLS credentials and router ports.
The NetworkAccess resource is used to implement inter-network access for sites.
type: object
properties:
spec:
type: object
properties:
port:
description: The port for the router to bind.
type: integer
generateTlsCredentials:
description: |-
When set, Skupper generates the TLS credentials to be
stored in the Secret specified by `tlsCredentials`. See
also `issuer`.
type: boolean
issuer:
type: string
description: |-
The name of the Kubernetes Secret containing the signing CA
used to generate TLS certificates for the NetworkAccess when
`generateTlsCredentials` is set.
remoteIssuer:
description: |-
Advanced. Enable it if you want the Skupper Controller to
generate CertificateRequests (CRs) instead of the default
self-signed certificates.
The CRs must be reconciled by an external application.
type: boolean
accessType:
description: |-
Configures the access type for the router endpoints.
Available access types and the default selection is
configured on the Skupper controller for Kubernetes.

The options available by default are:
- `local`: No external ingress. Implies a Kubernetes Service with type ClusterIP.
- `route`: Exposed via an OpenShift Route.
- `loadbalancer`: Exposed via a Kubernetes Service with type LoadBalancer.
type: string
tlsCredentials:
description: |-
The name of a bundle of TLS certificates used for mutual TLS
router-to-router communication. The bundle contains the
server certificate and key and the trusted client certificate
(usually a CA).

On Kubernetes, the value is the name of a Secret in the
current namespace.

On Docker, Podman, and Linux, the value is the name of a
directory under `input/certs/` in the current namespace.
type: string
bindHost:
description: |-
The hostname or IP address of the network interface to bind
to. By default, Skupper binds all the interfaces on the host.
type: string
subjectAlternativeNames:
type: array
description: |-
The hostnames and IPs secured by the router TLS certificate.
items:
type: string
settings:
description: |-
Advanced. A map containing additional settings. Each map
entry has a string name and a string value.

**Note:** In general, we recommend not changing `settings`
from their default values.
type: object
additionalProperties:
type: string
required:
- tlsCredentials
status:
type: object
properties:
status:
description: |-
The current state of the resource.
- `Pending`: The resource is being processed.
- `Error`: There was an error processing the resource. See `message` for more information.
- `Ready`: The resource is ready to use.
type: string
message:
description: |-
A human-readable status message. Error messages are reported here.
type: string
networkId:
description: |-
The network id currently associated with the Network Access.
type: string
port:
description: |-
If a port is not specified, the controller assigns a dynamic port and reports it here.
type: integer
conditions:
type: array
description: |-
A set of named conditions describing the current state of the resource.

- `Configured`: The output resources for this resource have been created.
- `Resolved`: The connection endpoints are available.
- `Ready`: The router access is ready for use. All other conditions are true.
items:
type: object
properties:
lastTransitionTime:
format: date-time
type: string
message:
maxLength: 32768
type: string
observedGeneration:
format: int64
minimum: 0
type: integer
reason:
maxLength: 1024
minLength: 1
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
type: string
status:
enum:
- "True"
- "False"
- Unknown
type: string
type:
maxLength: 316
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
type: string
required:
- lastTransitionTime
- message
- reason
- status
- type
endpoints:
type: array
description: |-
An array of connection endpoints. Each item has a name, host,
port, and group.
items:
type: object
properties:
name:
type: string
host:
type: string
port:
type: string
group:
type: string
subresources:
status: {}
additionalPrinterColumns:
- name: Status
type: string
description: The status of the router access
jsonPath: .status.status
- name: Message
type: string
description: Any relevant human readable message
jsonPath: .status.message
scope: Namespaced
names:
plural: networkaccesses
singular: networkaccess
kind: NetworkAccess
Loading
Loading