Add CableDriverOptions to Submariner CR

api/v1alpha1/submariner_types.go

@@ -69,6 +69,12 @@ type SubmarinerSpec struct {
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:select:libreswan","urn:alm:descriptor:com.tectonic.ui:select:vxlan","urn:alm:descriptor:com.tectonic.ui:select:wireguard"}
 	CableDriver string `json:"cableDriver,omitempty"`
 
+	// Driver-specific options passed to the selected cable driver (for example AmneziaWG
+	// obfuscation parameters). Unknown keys are ignored by drivers that do not use them.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Cable Driver Options"
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:advanced"}
+	CableDriverOptions map[string]string `json:"cableDriverOptions,omitempty"`
+
 	// The IPsec Pre-Shared Key which must be identical in all route agents across the cluster.
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="IPsec Pre-Shared Key"
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:password"}

bundle/manifests/submariner.clusterserviceversion.yaml

@@ -202,6 +202,13 @@ spec:
         - urn:alm:descriptor:com.tectonic.ui:select:libreswan
         - urn:alm:descriptor:com.tectonic.ui:select:vxlan
         - urn:alm:descriptor:com.tectonic.ui:select:wireguard
+      - description: |-
+          Driver-specific options passed to the selected cable driver (for example AmneziaWG
+          obfuscation parameters). Unknown keys are ignored by drivers that do not use them.
+        displayName: Cable Driver Options
+        path: cableDriverOptions
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
       - description: Enable logging IPsec debugging information.
         displayName: IPsec Debug
         path: ceIPSecDebug

bundle/manifests/submariner.io_submariners.yaml

@@ -64,6 +64,13 @@ spec:
                 description: Cable driver implementation - any of [libreswan, wireguard,
                   vxlan].
                 type: string
+              cableDriverOptions:
+                additionalProperties:
+                  type: string
+                description: Driver-specific options passed to the selected cable
+                  driver (for example AmneziaWG obfuscation parameters). Unknown keys
+                  are ignored by drivers that do not use them.
+                type: object
               ceIPSecDebug:
                 description: Enable logging IPsec debugging information.
                 type: boolean

config/crd/bases/submariner.io_submariners.yaml

@@ -64,6 +64,13 @@ spec:
                 description: Cable driver implementation - any of [libreswan, wireguard,
                   vxlan].
                 type: string
+              cableDriverOptions:
+                additionalProperties:
+                  type: string
+                description: Driver-specific options passed to the selected cable driver
+                  (for example AmneziaWG obfuscation parameters). Unknown keys are
+                  ignored by drivers that do not use them.
+                type: object
               ceIPSecDebug:
                 description: Enable logging IPsec debugging information.
                 type: boolean

config/manifests/bases/submariner.clusterserviceversion.yaml

@@ -131,6 +131,13 @@ spec:
         - urn:alm:descriptor:com.tectonic.ui:select:libreswan
         - urn:alm:descriptor:com.tectonic.ui:select:vxlan
         - urn:alm:descriptor:com.tectonic.ui:select:wireguard
+      - description: |-
+          Driver-specific options passed to the selected cable driver (for example AmneziaWG
+          obfuscation parameters). Unknown keys are ignored by drivers that do not use them.
+        displayName: Cable Driver Options
+        path: cableDriverOptions
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
       - description: Enable logging IPsec debugging information.
         displayName: IPsec Debug
         path: ceIPSecDebug

deploy/crds/submariner.io_submariners.yaml

@@ -64,6 +64,13 @@ spec:
                 description: Cable driver implementation - any of [libreswan, wireguard,
                   vxlan].
                 type: string
+              cableDriverOptions:
+                additionalProperties:
+                  type: string
+                description: Driver-specific options passed to the selected cable driver
+                  (for example AmneziaWG obfuscation parameters). Unknown keys are
+                  ignored by drivers that do not use them.
+                type: object
               ceIPSecDebug:
                 description: Enable logging IPsec debugging information.
                 type: boolean

internal/controllers/submariner/gateway_resources.go

@@ -20,6 +20,7 @@ package submariner
 
 import (
 	"context"
+	"encoding/json"
 	"strconv"
 
 	"github.com/go-logr/logr"
@@ -265,6 +266,13 @@ func newGatewayPodTemplate(cr *v1alpha1.Submariner, name string, podSelectorLabe
 			cr.Spec.LoadBalancerEnabled)},
 		corev1.EnvVar{Name: "CE_IPSEC_FORCEENCAPS", Value: strconv.FormatBool(cr.Spec.CeIPSecForceUDPEncaps)})
 
+	if len(cr.Spec.CableDriverOptions) > 0 {
+		// map[string]string always encodes successfully.
+		optionsJSON, _ := json.Marshal(cr.Spec.CableDriverOptions)
+		podTemplate.Spec.Containers[0].Env = append(podTemplate.Spec.Containers[0].Env,
+			corev1.EnvVar{Name: "SUBMARINER_CABLEDRIVEROPTIONS", Value: string(optionsJSON)})
+	}
+
 	if cr.Spec.LoadBalancerEnabled {
 		podTemplate.Spec.Containers[0].Env = append(podTemplate.Spec.Containers[0].Env,
 			corev1.EnvVar{Name: "SUBMARINER_PUBLICIP", Value: "lb:" + loadBalancerName})

internal/controllers/submariner/submariner_controller_test.go

@@ -213,6 +213,24 @@ func testDaemonSetReconciliation() {
 			})
 	})
 
+	When("CableDriverOptions are set", func() {
+		BeforeEach(func() {
+			t.submariner.Spec.CableDriverOptions = map[string]string{
+				"jc": "3",
+				"h1": "10-20",
+			}
+		})
+
+		Specify("the submariner gateway DaemonSet should have SUBMARINER_CABLEDRIVEROPTIONS set",
+			func(ctx SpecContext) {
+				t.AssertReconcileSuccess(ctx)
+
+				daemonSet := t.AssertDaemonSet(ctx, names.GatewayComponent)
+				Expect(test.EnvMapFrom(daemonSet)).To(HaveKeyWithValue("SUBMARINER_CABLEDRIVEROPTIONS",
+					`{"h1":"10-20","jc":"3"}`))
+			})
+	})
+
 	When("the submariner route-agent DaemonSet doesn't exist", func() {
 		It("should create it", func(ctx SpecContext) {
 			t.AssertReconcileSuccess(ctx)