Skip to content

Add PreExistingVPCNetworkConfigAnnotation #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ihgann wants to merge 1 commit into
base: master
Choose a base branch
from
+8 −0
Draft

Add PreExistingVPCNetworkConfigAnnotation #62

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions api/v1alpha1/namespacenetworkconfiguration_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,14 @@ const (
// resource.
NamespaceNetworkProtectionFinalizer = "netoperator.vmware.com/nnc-protection"

// PreExistingVPCNetworkConfigAnnotation, when set on a
// NamespaceNetworkConfiguration, names a pre-existing VPCNetworkConfiguration
// for net-operator's VPC reconciler to adopt in place of the CR it would
// otherwise auto-create (named after this resource). This supports brownfield
// namespaces whose VPCNetworkConfiguration was provisioned before adoption by
// this NamespaceNetworkConfiguration.

@yangna0420 yangna0420 Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since modifying or deleting this annotation after successful reconciliation could lead to unintended VPC overrides or recreate loops, we should enforce its immutability.

Can we add a CEL (Common Expression Language) XValidation rule directly on the CRD struct NamespaceNetworkConfiguration, or enforce this via a validating webhook to reject any UPDATE calls that attempt to change/remove this annotation?

Draft CEL Rule Example (optional to append):
// +kubebuilder:validation:XValidation:rule="oldSelf.metadata.annotations.exists(x, x == 'netoperator.vmware.com/vpc-network-configuration') ? self.metadata.annotations['netoperator.vmware.com/vpc-network-configuration'] == oldSelf.metadata.annotations['netoperator.vmware.com/vpc-network-configuration'] : true",message="The pre-existing VPC network configuration annotation is immutable once set"

PreExistingVPCNetworkConfigAnnotation = "netoperator.vmware.com/vpc-network-configuration"

@yangna0420 yangna0420 Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The current key name "netoperator.vmware.com/vpc-network-configuration" is somewhat generic and doesn't clearly reflect the adoption/brownfield intent.

Could we consider renaming it to something more explicit and self-documenting? For example:

  • "netoperator.vmware.com/adopt-vpc-network-configuration"
  • "netoperator.vmware.com/pre-existing-vpc-network-configuration"


// NamespaceNetworkConditionReady is True when all networking resources owned
// by the NamespaceNetworkConfiguration have been created and every associated
// Namespace has been fully reconciled. When no Namespaces are associated,
Expand Down