Konnect entities: Konnect Cloud Gateways Network (#1136)

* feat(konnect): add Konnect Cloud Gateways Network reconciler

* chore: add godoc for replaceFirstSegmentToGlobal

* chore: use kcfg from main

* chore: regenerate

.github/workflows/tests.yaml

@@ -117,7 +117,7 @@ jobs:
       run: make test.samples
 
     - name: Verify that uninstalling operator CRDs via kustomize works
-      run: make uninstall.all
+      run: make ignore-not-found=true uninstall.all
 
   install-with-kustomize:
     runs-on: ubuntu-latest

.mockery.yaml

@@ -11,6 +11,7 @@ packages:
   github.com/kong/gateway-operator/controller/konnect/ops/sdk:
     interfaces:
       ControlPlaneSDK:
+      CloudGatewaysSDK:
       ControlPlaneGroupSDK:
       ServicesSDK:
       RoutesSDK:

CHANGELOG.md

@@ -61,6 +61,9 @@
   - `gateway_operator_konnect_entity_operation_count` for number of operations.
   - `gateway_operator_konnect_entity_operation_duration_milliseconds` for duration of operations.
   [#953](https://github.com/Kong/gateway-operator/pull/953)
+- Added support for `KonnectCloudGatewayNetwork` CRD which can manage Konnect
+  Cloud Gateway Network entities.
+  [#1136](https://github.com/Kong/gateway-operator/pull/1136)
 
 ### Changed
 

Makefile

@@ -503,7 +503,7 @@ install-gateway-api-crds: go-mod-download-gateway-api kustomize
 
 .PHONY: uninstall-gateway-api-crds
 uninstall-gateway-api-crds: go-mod-download-gateway-api kustomize
-	$(KUSTOMIZE) build $(GATEWAY_API_CRDS_LOCAL_PATH) | kubectl delete -f -
+	$(KUSTOMIZE) build $(GATEWAY_API_CRDS_LOCAL_PATH) | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
 
 # ------------------------------------------------------------------------------
 # Debug
@@ -608,7 +608,7 @@ KUBERNETES_CONFIGURATION_CRDS_CRDS_LOCAL_PATH = $(shell go env GOPATH)/pkg/mod/$
 # Install kubernetes-configuration CRDs into the K8s cluster specified in ~/.kube/config.
 .PHONY: install.kubernetes-configuration-crds
 install.kubernetes-configuration-crds: kustomize
-	$(KUSTOMIZE) build $(KUBERNETES_CONFIGURATION_CRDS_CRDS_LOCAL_PATH) | kubectl apply -f -
+	$(KUSTOMIZE) build $(KUBERNETES_CONFIGURATION_CRDS_CRDS_LOCAL_PATH) | kubectl apply --server-side -f -
 
 # Install RBACs from config/rbac into the K8s cluster specified in ~/.kube/config.
 .PHONY: install.rbacs
@@ -629,7 +629,7 @@ uninstall: manifests kustomize uninstall-gateway-api-crds
 
 .PHONY: uninstall.kubernetes-configuration-crds
 uninstall.kubernetes-configuration-crds: kustomize
-	$(KUSTOMIZE) build $(KUBERNETES_CONFIGURATION_CRDS_CRDS_LOCAL_PATH) | kubectl delete -f -
+	$(KUSTOMIZE) build $(KUBERNETES_CONFIGURATION_CRDS_CRDS_LOCAL_PATH) | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
 
 # Uninstall standard and experimental CRDs from the K8s cluster specified in ~/.kube/config.
 # Call with ignore-not-found=true to ignore resource not found errors during deletion.

api/v1alpha1/konnect_extension_types.go

@@ -16,7 +16,7 @@ limitations under the License.
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	configurationv1alpha1 "github.com/kong/kubernetes-configuration/api/configuration/v1alpha1"
+	commonv1alpha1 "github.com/kong/kubernetes-configuration/api/common/v1alpha1"
 )
 
 func init() {
@@ -66,7 +66,7 @@ type KonnectExtensionSpec struct {
 	// ControlPlaneRef is a reference to a ControlPlane this KonnectExtension is associated with.
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:XValidation:rule="self.type == 'konnectID'", message="Only konnectID type currently supported as controlPlaneRef."
-	ControlPlaneRef configurationv1alpha1.ControlPlaneRef `json:"controlPlaneRef"`
+	ControlPlaneRef commonv1alpha1.ControlPlaneRef `json:"controlPlaneRef"`
 
 	// ControlPlaneRegion is the region of the Konnect Control Plane.
 	//

config/rbac/role/role.yaml

@@ -382,6 +382,7 @@ rules:
   - konnect.konghq.com
   resources:
   - konnectapiauthconfigurations
+  - konnectcloudgatewaynetworks
   - konnectgatewaycontrolplanes
   verbs:
   - get
@@ -394,6 +395,8 @@ rules:
   resources:
   - konnectapiauthconfigurations/finalizers
   - konnectapiauthconfigurations/status
+  - konnectcloudgatewaynetworks/finalizers
+  - konnectcloudgatewaynetworks/status
   - konnectgatewaycontrolplanes/finalizers
   - konnectgatewaycontrolplanes/status
   verbs:

config/samples/konnect_cloudgateway_network.yaml

@@ -0,0 +1,25 @@
+kind: KonnectAPIAuthConfiguration
+apiVersion: konnect.konghq.com/v1alpha1
+metadata:
+  name: konnect-api-auth
+  namespace: default
+spec:
+  type: token
+  token: kpat_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+  serverURL: us.api.konghq.com
+---
+kind: KonnectCloudGatewayNetwork
+apiVersion: konnect.konghq.com/v1alpha1
+metadata:
+  name: konnect-network-1
+  namespace: default
+spec:
+  name: network1
+  cloud_gateway_provider_account_id: "1234"
+  availability_zones:
+  - us-west-1
+  cidr_block: "10.0.0.1/24"
+  region: us-west
+  konnect:
+    authRef:
+      name: konnect-api-auth

controller/dataplane/konnectextension_test.go

@@ -20,7 +20,7 @@ import (
 	"github.com/kong/gateway-operator/pkg/consts"
 	k8sutils "github.com/kong/gateway-operator/pkg/utils/kubernetes"
 
-	configurationv1alpha1 "github.com/kong/kubernetes-configuration/api/configuration/v1alpha1"
+	commonv1alpha1 "github.com/kong/kubernetes-configuration/api/common/v1alpha1"
 )
 
 func TestApplyKonnectExtension(t *testing.T) {
@@ -82,7 +82,7 @@ func TestApplyKonnectExtension(t *testing.T) {
 							Name: "cluster-cert-secret",
 						},
 					},
-					ControlPlaneRef: configurationv1alpha1.ControlPlaneRef{
+					ControlPlaneRef: commonv1alpha1.ControlPlaneRef{
 						KonnectID: lo.ToPtr("konnect-id"),
 					},
 					ControlPlaneRegion: "us-west",
@@ -154,7 +154,7 @@ func TestApplyKonnectExtension(t *testing.T) {
 							Name: "cluster-cert-secret",
 						},
 					},
-					ControlPlaneRef: configurationv1alpha1.ControlPlaneRef{
+					ControlPlaneRef: commonv1alpha1.ControlPlaneRef{
 						KonnectID: lo.ToPtr("konnect-id"),
 					},
 					ControlPlaneRegion: "us-west",
@@ -199,7 +199,7 @@ func TestApplyKonnectExtension(t *testing.T) {
 							Name: "cluster-cert-secret",
 						},
 					},
-					ControlPlaneRef: configurationv1alpha1.ControlPlaneRef{
+					ControlPlaneRef: commonv1alpha1.ControlPlaneRef{
 						KonnectID: lo.ToPtr("konnect-id"),
 					},
 					ControlPlaneRegion: "us-west",
@@ -263,7 +263,7 @@ func TestApplyKonnectExtension(t *testing.T) {
 							Name: "cluster-cert-secret",
 						},
 					},
-					ControlPlaneRef: configurationv1alpha1.ControlPlaneRef{
+					ControlPlaneRef: commonv1alpha1.ControlPlaneRef{
 						KonnectID: lo.ToPtr("konnect-id"),
 					},
 					ControlPlaneRegion: "us-west",

controller/konnect/constraints/constraints.go

@@ -32,6 +32,7 @@ type KongCredential[T SupportedCredentialType] interface {
 // must implement.
 type SupportedKonnectEntityType interface {
 	konnectv1alpha1.KonnectGatewayControlPlane |
+		konnectv1alpha1.KonnectCloudGatewayNetwork |
 		configurationv1alpha1.KongService |
 		configurationv1alpha1.KongRoute |
 		configurationv1.KongConsumer |

controller/konnect/errors.go

@@ -6,13 +6,13 @@ import (
 
 	"k8s.io/apimachinery/pkg/types"
 
-	configurationv1alpha1 "github.com/kong/kubernetes-configuration/api/configuration/v1alpha1"
+	commonv1alpha1 "github.com/kong/kubernetes-configuration/api/common/v1alpha1"
 )
 
 // ReferencedControlPlaneDoesNotExistError is an error type that is returned when
 // a Konnect entity references a KonnectGatewayControlPlane that does not exist.
 type ReferencedControlPlaneDoesNotExistError struct {
-	Reference configurationv1alpha1.ControlPlaneRef
+	Reference commonv1alpha1.ControlPlaneRef
 	Err       error
 }
 
@@ -142,7 +142,7 @@ func (e ReferencedKongKeySetIsBeingDeleted) Error() string {
 // ReferencedKongGatewayControlPlaneIsUnsupported is an error type that is returned when a given CP reference type is not
 // supported.
 type ReferencedKongGatewayControlPlaneIsUnsupported struct {
-	Reference configurationv1alpha1.ControlPlaneRef
+	Reference commonv1alpha1.ControlPlaneRef
 }
 
 func (e ReferencedKongGatewayControlPlaneIsUnsupported) Error() string {

controller/konnect/index_konnectcloudgatewaynetwork.go

@@ -0,0 +1,32 @@
+package konnect
+
+import (
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	konnectv1alpha1 "github.com/kong/kubernetes-configuration/api/konnect/v1alpha1"
+)
+
+const (
+	// IndexFieldKonnectCloudGatewayNetworkOnAPIAuthConfiguration is the index field for KonnectCloudGatewayNetwork -> APIAuthConfiguration.
+	IndexFieldKonnectCloudGatewayNetworkOnAPIAuthConfiguration = "konnectCloudGatewayNetworkAPIAuthConfigurationRef"
+)
+
+// IndexOptionsForKonnectCloudGatewayNetwork returns required Index options for KonnectCloudGatewayNetwork reconciler.
+func IndexOptionsForKonnectCloudGatewayNetwork() []ReconciliationIndexOption {
+	return []ReconciliationIndexOption{
+		{
+			IndexObject:  &konnectv1alpha1.KonnectCloudGatewayNetwork{},
+			IndexField:   IndexFieldKonnectCloudGatewayNetworkOnAPIAuthConfiguration,
+			ExtractValue: konnectCloudGatewayNetworkAPIAuthConfigurationRef,
+		},
+	}
+}
+
+func konnectCloudGatewayNetworkAPIAuthConfigurationRef(object client.Object) []string {
+	cp, ok := object.(*konnectv1alpha1.KonnectCloudGatewayNetwork)
+	if !ok {
+		return nil
+	}
+
+	return []string{cp.Spec.KonnectConfiguration.APIAuthConfigurationRef.Name}
+}

controller/konnect/index_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/kong/gateway-operator/controller/konnect/constraints"
 	"github.com/kong/gateway-operator/modules/manager/scheme"
 
+	commonv1alpha1 "github.com/kong/kubernetes-configuration/api/common/v1alpha1"
 	configurationv1alpha1 "github.com/kong/kubernetes-configuration/api/configuration/v1alpha1"
 	konnectv1alpha1 "github.com/kong/kubernetes-configuration/api/konnect/v1alpha1"
 )
@@ -45,7 +46,7 @@ func TestIndexKonnectGatewayControlPlaneRef(t *testing.T) {
 						Name:      "obj1",
 					},
 					Spec: configurationv1alpha1.KongServiceSpec{
-						ControlPlaneRef: &configurationv1alpha1.ControlPlaneRef{
+						ControlPlaneRef: &commonv1alpha1.ControlPlaneRef{
 							Type: configurationv1alpha1.ControlPlaneRefKonnectNamespacedRef,
 							KonnectNamespacedRef: &configurationv1alpha1.KonnectNamespacedRef{
 								Name: "cp-1",
@@ -63,7 +64,7 @@ func TestIndexKonnectGatewayControlPlaneRef(t *testing.T) {
 						Name:      "obj1",
 					},
 					Spec: configurationv1alpha1.KongServiceSpec{
-						ControlPlaneRef: &configurationv1alpha1.ControlPlaneRef{
+						ControlPlaneRef: &commonv1alpha1.ControlPlaneRef{
 							Type: configurationv1alpha1.ControlPlaneRefKonnectNamespacedRef,
 							KonnectNamespacedRef: &configurationv1alpha1.KonnectNamespacedRef{
 								Name:      "cp-1",
@@ -82,7 +83,7 @@ func TestIndexKonnectGatewayControlPlaneRef(t *testing.T) {
 						Name:      "obj1",
 					},
 					Spec: configurationv1alpha1.KongServiceSpec{
-						ControlPlaneRef: &configurationv1alpha1.ControlPlaneRef{
+						ControlPlaneRef: &commonv1alpha1.ControlPlaneRef{
 							Type: configurationv1alpha1.ControlPlaneRefKonnectNamespacedRef,
 							KonnectNamespacedRef: &configurationv1alpha1.KonnectNamespacedRef{
 								Name:      "cp-1",
@@ -112,7 +113,7 @@ func TestIndexKonnectGatewayControlPlaneRef(t *testing.T) {
 						Name:      "obj1",
 					},
 					Spec: configurationv1alpha1.KongRouteSpec{
-						ControlPlaneRef: &configurationv1alpha1.ControlPlaneRef{
+						ControlPlaneRef: &commonv1alpha1.ControlPlaneRef{
 							Type: configurationv1alpha1.ControlPlaneRefKonnectNamespacedRef,
 							KonnectNamespacedRef: &configurationv1alpha1.KonnectNamespacedRef{
 								Name: "cp-1",
@@ -130,7 +131,7 @@ func TestIndexKonnectGatewayControlPlaneRef(t *testing.T) {
 						Name:      "obj1",
 					},
 					Spec: configurationv1alpha1.KongRouteSpec{
-						ControlPlaneRef: &configurationv1alpha1.ControlPlaneRef{
+						ControlPlaneRef: &commonv1alpha1.ControlPlaneRef{
 							Type: configurationv1alpha1.ControlPlaneRefKonnectNamespacedRef,
 							KonnectNamespacedRef: &configurationv1alpha1.KonnectNamespacedRef{
 								Name:      "cp-1",
@@ -149,7 +150,7 @@ func TestIndexKonnectGatewayControlPlaneRef(t *testing.T) {
 						Name:      "obj1",
 					},
 					Spec: configurationv1alpha1.KongRouteSpec{
-						ControlPlaneRef: &configurationv1alpha1.ControlPlaneRef{
+						ControlPlaneRef: &commonv1alpha1.ControlPlaneRef{
 							Type: configurationv1alpha1.ControlPlaneRefKonnectNamespacedRef,
 							KonnectNamespacedRef: &configurationv1alpha1.KonnectNamespacedRef{
 								Name:      "cp-1",

controller/konnect/kongpluginbuilder.go

@@ -7,6 +7,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
+	commonv1alpha1 "github.com/kong/kubernetes-configuration/api/common/v1alpha1"
 	configurationv1alpha1 "github.com/kong/kubernetes-configuration/api/configuration/v1alpha1"
 )
 
@@ -49,7 +50,7 @@ func (b *KongPluginBindingBuilder) WithPluginRef(pluginName string) *KongPluginB
 // WithControlPlaneRef sets the control plane reference of the KongPluginBinding.
 // NOTE: Users have to ensure that the ControlPlaneRef that's set here
 // is the same across all the KongPluginBinding targets.
-func (b *KongPluginBindingBuilder) WithControlPlaneRef(ref configurationv1alpha1.ControlPlaneRef) *KongPluginBindingBuilder {
+func (b *KongPluginBindingBuilder) WithControlPlaneRef(ref commonv1alpha1.ControlPlaneRef) *KongPluginBindingBuilder {
 	b.binding.Spec.ControlPlaneRef = ref
 	return b
 }
@@ -58,8 +59,8 @@ func (b *KongPluginBindingBuilder) WithControlPlaneRef(ref configurationv1alpha1
 // NOTE: Users have to ensure that the ControlPlaneRef that's set here
 // is the same across all the KongPluginBinding targets.
 func (b *KongPluginBindingBuilder) WithControlPlaneRefKonnectNamespaced(name string) *KongPluginBindingBuilder {
-	b.binding.Spec.ControlPlaneRef = configurationv1alpha1.ControlPlaneRef{
-		Type: configurationv1alpha1.ControlPlaneRefKonnectNamespacedRef,
+	b.binding.Spec.ControlPlaneRef = commonv1alpha1.ControlPlaneRef{
+		Type: commonv1alpha1.ControlPlaneRefKonnectNamespacedRef,
 		KonnectNamespacedRef: &configurationv1alpha1.KonnectNamespacedRef{
 			Name: name,
 		},

controller/konnect/ops/ops.go

@@ -32,6 +32,8 @@ type Op string
 const (
 	// CreateOp is the operation type for creating a Konnect entity.
 	CreateOp Op = "create"
+	// GetOp is the operation type for getting a Konnect entity.
+	GetOp Op = "get"
 	// UpdateOp is the operation type for updating a Konnect entity.
 	UpdateOp Op = "update"
 	// DeleteOp is the operation type for deleting a Konnect entity.
@@ -59,6 +61,8 @@ func Create[
 	switch ent := any(e).(type) {
 	case *konnectv1alpha1.KonnectGatewayControlPlane:
 		err = createControlPlane(ctx, sdk.GetControlPlaneSDK(), sdk.GetControlPlaneGroupSDK(), cl, ent)
+	case *konnectv1alpha1.KonnectCloudGatewayNetwork:
+		err = createKonnectNetwork(ctx, sdk.GetCloudGatewaysSDK(), ent)
 	case *configurationv1alpha1.KongService:
 		err = createService(ctx, sdk.GetServicesSDK(), ent)
 	case *configurationv1alpha1.KongRoute:
@@ -115,6 +119,8 @@ func Create[
 		switch ent := any(e).(type) {
 		case *konnectv1alpha1.KonnectGatewayControlPlane:
 			id, err = getControlPlaneForUID(ctx, sdk.GetControlPlaneSDK(), sdk.GetControlPlaneGroupSDK(), cl, ent)
+		case *konnectv1alpha1.KonnectCloudGatewayNetwork:
+			id, err = getKonnectNetworkForUID(ctx, sdk.GetCloudGatewaysSDK(), ent)
 		case *configurationv1alpha1.KongService:
 			id, err = getKongServiceForUID(ctx, sdk.GetServicesSDK(), ent)
 		case *configurationv1alpha1.KongRoute:
@@ -226,6 +232,8 @@ func Delete[
 	switch ent := any(ent).(type) {
 	case *konnectv1alpha1.KonnectGatewayControlPlane:
 		err = deleteControlPlane(ctx, sdk.GetControlPlaneSDK(), ent)
+	case *konnectv1alpha1.KonnectCloudGatewayNetwork:
+		err = deleteKonnectNetwork(ctx, sdk.GetCloudGatewaysSDK(), ent)
 	case *configurationv1alpha1.KongService:
 		err = deleteService(ctx, sdk.GetServicesSDK(), ent)
 	case *configurationv1alpha1.KongRoute:
@@ -368,6 +376,8 @@ func Update[
 	switch ent := any(e).(type) {
 	case *konnectv1alpha1.KonnectGatewayControlPlane:
 		err = updateControlPlane(ctx, sdk.GetControlPlaneSDK(), sdk.GetControlPlaneGroupSDK(), cl, ent)
+	case *konnectv1alpha1.KonnectCloudGatewayNetwork:
+		err = updateKonnectNetwork(ctx, sdk.GetCloudGatewaysSDK(), ent)
 	case *configurationv1alpha1.KongService:
 		err = updateService(ctx, sdk.GetServicesSDK(), ent)
 	case *configurationv1alpha1.KongRoute:
@@ -490,6 +500,12 @@ func wrapErrIfKonnectOpFailed[
 	TEnt constraints.EntityType[T],
 ](err error, op Op, e TEnt) error {
 	if err != nil {
+		var errBadRequest *sdkkonnecterrs.BadRequestError
+		if errors.As(err, &errBadRequest) {
+			errBadRequest.Instance = ""
+			err = errBadRequest
+		}
+
 		entityTypeName := constraints.EntityTypeName[T]()
 		if e == nil {
 			return fmt.Errorf("failed to %s %s: %w",