Firewall integration again

DEVELOPMENT.md

@@ -18,10 +18,16 @@ Next install our CAPMS provider into the cluster.
 make push-to-capi-lab
 ```
 
-Before creating a cluster some manual steps are required beforehand: you need to allocate a node network and a firewall.
+Before creating a cluster some manual steps are required beforehand: you need to allocate a node network.
 
 ```bash
-make -C capi-lab node-network firewall
+make -C capi-lab node-network
+```
+
+If you want to allow management of the metal-stack firewall by cluster-api, deploy the [firewall-controller-manager](https://github.com/metal-stack/firewall-controller-manager), too.
+
+```bash
+make -C capi-lab deploy-fcm
 ```
 
 A basic cluster configuration that relies on `config/clusterctl-templates/cluster-template.yaml` and uses the aforementioned node network can be generated and applied to the management cluster using a make target.
@@ -268,7 +274,7 @@ export control_plane_machine_id=
 metalctl machine console --ipmi $control_plane_machine_id
 # ip r
 # sudo systemctl restart kubeadm
-# crictl ps 
+# crictl ps
 # ~.
 
 clusterctl get kubeconfig > capms-cluster.kubeconfig
@@ -308,7 +314,7 @@ Now you are able to move the cluster resources as you wish:
 ```bash
 clusterctl init --infrastructure metal-stack --kubeconfig capms-cluster.kubeconfig
 
-clusterctl move -n $NAMESPACE --kubeconfig kind-bootstrap.kubeconfig --to-kubeconfig capms-cluster.kubeconfig 
+clusterctl move -n $NAMESPACE --kubeconfig kind-bootstrap.kubeconfig --to-kubeconfig capms-cluster.kubeconfig
 # everything as expected
 kubectl --kubeconfig -n $NAMESPACE kind-bootstrap.kubeconfig get cluster,metalstackcluster,machine,metalstackmachine,kubeadmcontrolplanes,kubeadmconfigs
 kubectl --kubeconfig -n $NAMESPACE capms-cluster.kubeconfig get cluster,metalstackcluster,machine,metalstackmachine,kubeadmcontrolplanes,kubeadmconfigs

Makefile

@@ -77,7 +77,9 @@ update-test-crds:
 	go mod tidy
 	rm -rf test/external-crds
 	mkdir -p test/external-crds/cluster-api
+	mkdir -p test/external-crds/firewall-controller-manager
 	cp -f $(shell go list -mod=mod -m -f '{{.Dir}}' all | grep sigs.k8s.io/cluster-api)/config/crd/bases/* test/external-crds/cluster-api
+	cp -f $(shell go list -mod=mod -m -f '{{.Dir}}' all | grep metal-stack/firewall-controller-manager)/config/crds/* test/external-crds/firewall-controller-manager
 
 .PHONY: fmt
 fmt: ## Run go fmt against code.

api/v1alpha1/metalstackcluster_types.go

@@ -24,6 +24,7 @@ import (
 	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
 	capierrors "sigs.k8s.io/cluster-api/errors" //nolint:staticcheck
 
+	fcmv2 "github.com/metal-stack/firewall-controller-manager/api/v2"
 	"github.com/metal-stack/metal-lib/pkg/tag"
 )
 
@@ -35,8 +36,9 @@ const (
 
 	ClusterControlPlaneEndpointDefaultPort = 443
 
-	ClusterControlPlaneIPEnsured clusterv1.ConditionType = "ClusterControlPlaneIPEnsured"
-	ClusterPaused                clusterv1.ConditionType = clusterv1.PausedV1Beta2Condition
+	ClusterControlPlaneIPEnsured   clusterv1.ConditionType = "ClusterControlPlaneIPEnsured"
+	ClusterPaused                  clusterv1.ConditionType = clusterv1.PausedV1Beta2Condition
+	ClusterFirewallDeploymentReady clusterv1.ConditionType = "ClusterFirewallDeploymentReady"
 )
 
 var (
@@ -66,6 +68,11 @@ type MetalStackClusterSpec struct {
 
 	// Partition is the data center partition in which the resources are created.
 	Partition string `json:"partition"`
+
+	// Firewall describes the firewall for this cluster.
+	// If not provided this will automatically be created during reconcile.
+	// +optional
+	Firewall *Firewall `json:"firewall,omitempty"`
 }
 
 // APIEndpoint represents a reachable Kubernetes API endpoint.
@@ -77,6 +84,31 @@ type APIEndpoint struct {
 	Port int `json:"port"`
 }
 
+// Firewall defines parameters for the firewall creation along with configuration for the firewall-controller.
+type Firewall struct {
+	// Size is the machine size of the firewall.
+	// An update on this field requires the recreation of the physical firewall and can therefore lead to traffic interruption for the cluster.
+	Size string `json:"size"`
+	// Image is the os image of the firewall.
+	// An update on this field requires the recreation of the physical firewall and can therefore lead to traffic interruption for the cluster.
+	Image string `json:"image"`
+	// AdditionalNetworks are the networks to which this firewall is connected.
+	// An update on this field requires the recreation of the physical firewall and can therefore lead to traffic interruption for the cluster.
+	// +optional
+	AdditionalNetworks []string `json:"networks,omitempty"`
+
+	// RateLimits allows configuration of rate limit rules for interfaces.
+	// +optional
+	RateLimits []fcmv2.RateLimit `json:"rateLimits,omitempty"`
+	// EgressRules contains egress rules configured for this firewall.
+	// +optional
+	EgressRules []fcmv2.EgressRuleSNAT `json:"egressRules,omitempty"`
+
+	// LogAcceptedConnections if set to true, also log accepted connections in the droptailer log.
+	// +optional
+	LogAcceptedConnections *bool `json:"logAcceptedConnections,omitempty"`
+}
+
 // MetalStackClusterStatus defines the observed state of MetalStackCluster.
 type MetalStackClusterStatus struct {
 	// Ready denotes that the cluster is ready.

capi-lab/Makefile

@@ -21,6 +21,9 @@ CONTROL_PLANE_MACHINE_SIZE ?= v1-small-x86
 WORKER_MACHINE_IMAGE ?= ubuntu-24.04
 WORKER_MACHINE_SIZE ?= v1-small-x86
 
+FIREWALL_MACHINE_IMAGE ?= firewall-ubuntu-3.0
+FIREWALL_MACHINE_SIZE ?= v1-small-x86
+
 IMG ?= ghcr.io/metal-stack/cluster-api-metal-stack-controller:latest
 
 .PHONY: up
@@ -43,6 +46,7 @@ cleanup:
 dev-env:
 	@echo "export METALCTL_API_URL=${METALCTL_API_URL}"
 	@echo "export METALCTL_HMAC=${METALCTL_HMAC}"
+	@echo "export METALCTL_HMAC_AUTH_TYPE=${METALCTL_HMAC_AUTH_TYPE}"
 	@echo "export KUBECONFIG=${KUBECONFIG}"
 
 .PHONY: controller
@@ -63,6 +67,7 @@ node-network:
 .PHONY: apply-sample-cluster
 apply-sample-cluster:
 	$(eval METAL_NODE_NETWORK_ID = $(shell metalctl network list --name metal-test -o template --template '{{ .id }}'))
+	$(eval FIREWALL_NETWORKS =  ["internet-mini-lab"])
 	clusterctl generate cluster metal-test \
 		--kubeconfig=$(KUBECONFIG) \
 		--worker-machine-count 1 \
@@ -74,6 +79,7 @@ apply-sample-cluster:
 .PHONY: delete-sample-cluster
 delete-sample-cluster:
 	$(eval METAL_NODE_NETWORK_ID = $(shell metalctl network list --name metal-test -o template --template '{{ .id }}'))
+	$(eval FIREWALL_NETWORKS =  ["internet-mini-lab"])
 	clusterctl generate cluster metal-test \
 		--kubeconfig=$(KUBECONFIG) \
 		--worker-machine-count 1 \
@@ -91,4 +97,9 @@ mtu-fix:
 deploy-metal-ccm:
 	$(eval METAL_CLUSTER_ID = $(shell kubectl get metalstackclusters.infrastructure.cluster.x-k8s.io metal-test -ojsonpath='{.metadata.uid}'))
 	$(eval METAL_NODE_NETWORK_ID = $(shell metalctl network list --name metal-test -o template --template '{{ .id }}'))
+	$(eval FIREWALL_NETWORKS =  ["internet-mini-lab"])
 	cat metal-ccm.yaml | envsubst | kubectl --kubeconfig=.capms-cluster-kubeconfig.yaml apply -f -
+
+.PHONY: deploy-fcm
+deploy-fcm:
+	kubectl apply -k firewall-controller-manager