Add CableDriverOptions to Submariner CR

[sanek9]

What this PR does / why we need it

Adds cluster-wide spec.cableDriverOptions (map[string]string) on the Submariner CR
and injects it into the gateway as:

SUBMARINER_CABLEDRIVEROPTIONS=<json>

The field is intentionally driver-agnostic: it is an opaque key=value bag that the
selected cable driver may consume. Drivers that do not recognize a key simply ignore it.
That keeps peer-facing Endpoint.BackendConfig unchanged and avoids baking
driver-specific knobs into the CR schema (one field instead of a growing set of
AmneziaWG- / Libreswan- / WireGuard-only API fields).

Today the AmneziaWG driver is the first consumer (obfuscation parameters). The same
mechanism is meant for other drivers later without another CRD change. For Libreswan,
a natural fit would be things discussed in #1668 — for example selecting IKE/ESP
proposals / ciphers so hardware crypto offload can be used — rather than growing the
CR with more Libreswan-specific fields. WireGuard or future drivers can opt in the
same way via cable.GetDriverOptions().

Empty/absent map → env var is not set, so gateways keep built-in driver defaults
(compatible with older submariner images that do not read the variable yet).

More details

• Companion: AmneziaWG cable driver PR (reads the env var).
• Companion: subctl --cable-driver-option key=value to populate the CR at join time.
• CRD must be updated in both config/crd and deploy/crds (subctl installs from deploy).

Related issues

• Related to Configurable encryption settings in the cable driver submariner#1668 (earlier discussion of configurable cable/encryption settings; this is a narrower opaque-options approach rather than a broad IPsec settings API).

Depends on / related PRs

• Related: submariner AmneziaWG driver PR (first consumer)
• Follow-up: subctl --cable-driver-option

Checklist

• CRD / deepcopy updated (config/crd and deploy/crds)
• Tests added

Cross-links (this series)

• Companion (consumer): Add AmneziaWG cable driver submariner#4097
• Follow-up (subctl flag): will link after opening

Made with Cursor

Summary by CodeRabbit

• New Features
  • Added an optional spec.cableDriverOptions field to pass cable-driver-specific configuration.
  • Submariner now forwards these options to the gateway as a JSON-formatted environment variable when provided.
  • Updated the Submariner CustomResource schema/metadata to describe cableDriverOptions and clarify that unsupported option keys are ignored.
• Tests
  • Added reconciliation coverage to verify the gateway environment variable is set to the expected JSON when cableDriverOptions is provided.

[sanek9]

Follow-up subctl PR: >>> Creating PR #3: subctl feat/cable-driver-options -> devel
submariner-io/subctl#1830

[submariner-bot]

🤖 Created branch: z_pr4142/sanek9/feat/cable-driver-options
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f9d7e219-640d-429a-94ec-ef03ab0978c9

📥 Commits

Reviewing files that changed from the base of the PR and between 29c9efe and 36572da.

📒 Files selected for processing (9)

• api/v1alpha1/submariner_types.go
• api/v1alpha1/zz_generated.deepcopy.go
• bundle/manifests/submariner.clusterserviceversion.yaml
• bundle/manifests/submariner.io_submariners.yaml
• config/crd/bases/submariner.io_submariners.yaml
• config/manifests/bases/submariner.clusterserviceversion.yaml
• deploy/crds/submariner.io_submariners.yaml
• internal/controllers/submariner/gateway_resources.go
• internal/controllers/submariner/submariner_controller_test.go

🚧 Files skipped from review as they are similar to previous changes (4)

• api/v1alpha1/submariner_types.go
• internal/controllers/submariner/submariner_controller_test.go
• api/v1alpha1/zz_generated.deepcopy.go
• internal/controllers/submariner/gateway_resources.go

---

Walkthrough

The Submariner API and CRD schemas now support optional driver-specific cable options. The controller serializes non-empty options into SUBMARINER_CABLEDRIVEROPTIONS, with reconciliation coverage for the generated JSON.

Changes

Cable driver options

Layer / File(s)	Summary
Options API and schema contract api/v1alpha1/submariner_types.go, api/v1alpha1/zz_generated.deepcopy.go, config/crd/bases/..., deploy/crds/..., bundle/manifests/..., config/manifests/...	Adds the optional string map, deep-copy handling, CRD schemas, and advanced CSV descriptors.
Gateway environment propagation internal/controllers/submariner/gateway_resources.go, internal/controllers/submariner/submariner_controller_test.go	Marshals configured options into the gateway environment and verifies the generated JSON value.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: skitt, vthapar, sridhargaddam, oats87

Sequence Diagram(s)

sequenceDiagram
  participant SubmarinerCR
  participant newGatewayPodTemplate
  participant encodingjson
  participant GatewayDaemonSet
  SubmarinerCR->>newGatewayPodTemplate: Provide Spec.CableDriverOptions
  newGatewayPodTemplate->>encodingjson: Marshal options to JSON
  encodingjson-->>newGatewayPodTemplate: Return JSON string
  newGatewayPodTemplate->>GatewayDaemonSet: Set SUBMARINER_CABLEDRIVEROPTIONS

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding CableDriverOptions to the Submariner CR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Actionable Comments Resolved	✅ Passed	PASS: the new field, deepcopy, CRD/CSV manifests, gateway env injection, and test coverage are all present, matching the requested follow-ups.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sanek9]

Part of the proposal overview: submariner-io/submariner#4101

[tpantelis]

@sanek9 "Bundle validation" job failed which means you need to run make bundle and check in the changes.