From 36572da1e85cf109fe6146b2d51bb800d442ef84 Mon Sep 17 00:00:00 2001 From: sanek9 Date: Tue, 28 Jul 2026 01:12:13 +0200 Subject: [PATCH] Add CableDriverOptions to Submariner CR Expose cableDriverOptions on the Submariner CR and pass them to the gateway as SUBMARINER_CABLEDRIVEROPTIONS. Update OLM bundle manifests for the new field. Signed-off-by: sanek9 --- api/v1alpha1/submariner_types.go | 6 ++++++ api/v1alpha1/zz_generated.deepcopy.go | 7 +++++++ .../submariner.clusterserviceversion.yaml | 7 +++++++ .../manifests/submariner.io_submariners.yaml | 7 +++++++ .../crd/bases/submariner.io_submariners.yaml | 7 +++++++ .../submariner.clusterserviceversion.yaml | 7 +++++++ deploy/crds/submariner.io_submariners.yaml | 7 +++++++ .../submariner/gateway_resources.go | 8 ++++++++ .../submariner/submariner_controller_test.go | 18 ++++++++++++++++++ 9 files changed, 74 insertions(+) diff --git a/api/v1alpha1/submariner_types.go b/api/v1alpha1/submariner_types.go index 5b0d407df..843b882af 100644 --- a/api/v1alpha1/submariner_types.go +++ b/api/v1alpha1/submariner_types.go @@ -69,6 +69,12 @@ type SubmarinerSpec struct { // +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:select:libreswan","urn:alm:descriptor:com.tectonic.ui:select:vxlan","urn:alm:descriptor:com.tectonic.ui:select:wireguard"} CableDriver string `json:"cableDriver,omitempty"` + // Driver-specific options passed to the selected cable driver (for example AmneziaWG + // obfuscation parameters). Unknown keys are ignored by drivers that do not use them. + // +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Cable Driver Options" + // +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:advanced"} + CableDriverOptions map[string]string `json:"cableDriverOptions,omitempty"` + // The IPsec Pre-Shared Key which must be identical in all route agents across the cluster. // +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="IPsec Pre-Shared Key" // +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:password"} diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 29a01a5c5..22d5c58b4 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -424,6 +424,13 @@ func (in *SubmarinerSpec) DeepCopyInto(out *SubmarinerSpec) { (*out)[key] = val } } + if in.CableDriverOptions != nil { + in, out := &in.CableDriverOptions, &out.CableDriverOptions + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } if in.ConnectionHealthCheck != nil { in, out := &in.ConnectionHealthCheck, &out.ConnectionHealthCheck *out = new(HealthCheckSpec) diff --git a/bundle/manifests/submariner.clusterserviceversion.yaml b/bundle/manifests/submariner.clusterserviceversion.yaml index 70c905031..ba32be565 100644 --- a/bundle/manifests/submariner.clusterserviceversion.yaml +++ b/bundle/manifests/submariner.clusterserviceversion.yaml @@ -202,6 +202,13 @@ spec: - urn:alm:descriptor:com.tectonic.ui:select:libreswan - urn:alm:descriptor:com.tectonic.ui:select:vxlan - urn:alm:descriptor:com.tectonic.ui:select:wireguard + - description: |- + Driver-specific options passed to the selected cable driver (for example AmneziaWG + obfuscation parameters). Unknown keys are ignored by drivers that do not use them. + displayName: Cable Driver Options + path: cableDriverOptions + x-descriptors: + - urn:alm:descriptor:com.tectonic.ui:advanced - description: Enable logging IPsec debugging information. displayName: IPsec Debug path: ceIPSecDebug diff --git a/bundle/manifests/submariner.io_submariners.yaml b/bundle/manifests/submariner.io_submariners.yaml index 267c3ff87..5ae8d65f7 100644 --- a/bundle/manifests/submariner.io_submariners.yaml +++ b/bundle/manifests/submariner.io_submariners.yaml @@ -64,6 +64,13 @@ spec: description: Cable driver implementation - any of [libreswan, wireguard, vxlan]. type: string + cableDriverOptions: + additionalProperties: + type: string + description: Driver-specific options passed to the selected cable + driver (for example AmneziaWG obfuscation parameters). Unknown keys + are ignored by drivers that do not use them. + type: object ceIPSecDebug: description: Enable logging IPsec debugging information. type: boolean diff --git a/config/crd/bases/submariner.io_submariners.yaml b/config/crd/bases/submariner.io_submariners.yaml index 43c78c636..cec166971 100644 --- a/config/crd/bases/submariner.io_submariners.yaml +++ b/config/crd/bases/submariner.io_submariners.yaml @@ -64,6 +64,13 @@ spec: description: Cable driver implementation - any of [libreswan, wireguard, vxlan]. type: string + cableDriverOptions: + additionalProperties: + type: string + description: Driver-specific options passed to the selected cable driver + (for example AmneziaWG obfuscation parameters). Unknown keys are + ignored by drivers that do not use them. + type: object ceIPSecDebug: description: Enable logging IPsec debugging information. type: boolean diff --git a/config/manifests/bases/submariner.clusterserviceversion.yaml b/config/manifests/bases/submariner.clusterserviceversion.yaml index f79e96658..675a89322 100644 --- a/config/manifests/bases/submariner.clusterserviceversion.yaml +++ b/config/manifests/bases/submariner.clusterserviceversion.yaml @@ -131,6 +131,13 @@ spec: - urn:alm:descriptor:com.tectonic.ui:select:libreswan - urn:alm:descriptor:com.tectonic.ui:select:vxlan - urn:alm:descriptor:com.tectonic.ui:select:wireguard + - description: |- + Driver-specific options passed to the selected cable driver (for example AmneziaWG + obfuscation parameters). Unknown keys are ignored by drivers that do not use them. + displayName: Cable Driver Options + path: cableDriverOptions + x-descriptors: + - urn:alm:descriptor:com.tectonic.ui:advanced - description: Enable logging IPsec debugging information. displayName: IPsec Debug path: ceIPSecDebug diff --git a/deploy/crds/submariner.io_submariners.yaml b/deploy/crds/submariner.io_submariners.yaml index 43c78c636..cec166971 100644 --- a/deploy/crds/submariner.io_submariners.yaml +++ b/deploy/crds/submariner.io_submariners.yaml @@ -64,6 +64,13 @@ spec: description: Cable driver implementation - any of [libreswan, wireguard, vxlan]. type: string + cableDriverOptions: + additionalProperties: + type: string + description: Driver-specific options passed to the selected cable driver + (for example AmneziaWG obfuscation parameters). Unknown keys are + ignored by drivers that do not use them. + type: object ceIPSecDebug: description: Enable logging IPsec debugging information. type: boolean diff --git a/internal/controllers/submariner/gateway_resources.go b/internal/controllers/submariner/gateway_resources.go index 5c9651ae5..4278741fc 100644 --- a/internal/controllers/submariner/gateway_resources.go +++ b/internal/controllers/submariner/gateway_resources.go @@ -20,6 +20,7 @@ package submariner import ( "context" + "encoding/json" "strconv" "github.com/go-logr/logr" @@ -265,6 +266,13 @@ func newGatewayPodTemplate(cr *v1alpha1.Submariner, name string, podSelectorLabe cr.Spec.LoadBalancerEnabled)}, corev1.EnvVar{Name: "CE_IPSEC_FORCEENCAPS", Value: strconv.FormatBool(cr.Spec.CeIPSecForceUDPEncaps)}) + if len(cr.Spec.CableDriverOptions) > 0 { + // map[string]string always encodes successfully. + optionsJSON, _ := json.Marshal(cr.Spec.CableDriverOptions) + podTemplate.Spec.Containers[0].Env = append(podTemplate.Spec.Containers[0].Env, + corev1.EnvVar{Name: "SUBMARINER_CABLEDRIVEROPTIONS", Value: string(optionsJSON)}) + } + if cr.Spec.LoadBalancerEnabled { podTemplate.Spec.Containers[0].Env = append(podTemplate.Spec.Containers[0].Env, corev1.EnvVar{Name: "SUBMARINER_PUBLICIP", Value: "lb:" + loadBalancerName}) diff --git a/internal/controllers/submariner/submariner_controller_test.go b/internal/controllers/submariner/submariner_controller_test.go index f75b38efa..57dce12b1 100644 --- a/internal/controllers/submariner/submariner_controller_test.go +++ b/internal/controllers/submariner/submariner_controller_test.go @@ -213,6 +213,24 @@ func testDaemonSetReconciliation() { }) }) + When("CableDriverOptions are set", func() { + BeforeEach(func() { + t.submariner.Spec.CableDriverOptions = map[string]string{ + "jc": "3", + "h1": "10-20", + } + }) + + Specify("the submariner gateway DaemonSet should have SUBMARINER_CABLEDRIVEROPTIONS set", + func(ctx SpecContext) { + t.AssertReconcileSuccess(ctx) + + daemonSet := t.AssertDaemonSet(ctx, names.GatewayComponent) + Expect(test.EnvMapFrom(daemonSet)).To(HaveKeyWithValue("SUBMARINER_CABLEDRIVEROPTIONS", + `{"h1":"10-20","jc":"3"}`)) + }) + }) + When("the submariner route-agent DaemonSet doesn't exist", func() { It("should create it", func(ctx SpecContext) { t.AssertReconcileSuccess(ctx)