Add network egress resource (#357)

This change adds a new import resource which enables exposing Netbird
resources as Kubernetes services. This remove the need to add sidecars
to every pod.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a new `NetworkEgress` custom resource (`netbird.io/v1alpha1`)
with CRD, schema validation, and status/conditions.
* Extended controller functionality to create egress services and
translate egress rules into import `EndpointSlice` resources; egress
pods now include a kube-egress-forwarder sidecar.
* **Bug Fixes**
* Added missing deep-copy and declarative apply support for the new
`NetworkEgress` API types.
* **Documentation**
* Updated README/API reference and added example manifests for
`NetworkEgress` (including IP/FQDN target usage).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Philip Laine <philip.laine@gmail.com>

Author: phillebaba

.golangci.yml

@@ -65,6 +65,8 @@ linters:
           alias: admissionv1
         - pkg: k8s.io/api/policy/v1
           alias: policyv1
+        - pkg: "k8s.io/api/discovery/v1"
+          alias: discoveryv1
         - pkg: k8s.io/client-go/applyconfigurations/meta/v1
           alias: metav1ac
         - pkg: k8s.io/client-go/applyconfigurations/core/v1
@@ -75,6 +77,8 @@ linters:
           alias: appsv1ac
         - pkg: k8s.io/client-go/applyconfigurations/policy/v1
           alias: policyv1ac
+        - pkg: k8s.io/client-go/applyconfigurations/discovery/v1
+          alias: discoveryv1ac
 
         - pkg: sigs.k8s.io/gateway-api/apis/v1
           alias: gwv1

PROJECT

@@ -123,4 +123,12 @@ resources:
   kind: ClusterProxy
   path: github.com/netbirdio/kubernetes-operator/api/v1alpha1
   version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  controller: true
+  domain: netbird.io
+  kind: NetworkEgress
+  path: github.com/netbirdio/kubernetes-operator/api/v1alpha1
+  version: v1alpha1
 version: "3"

README.md

@@ -23,9 +23,10 @@ helm upgrade --install --create-namespace -n netbird netbird-operator oci://ghcr
 
 | Kind | API Version |
 |------|-------------|
+| [SetupKey](docs/api-reference.md#setupkey) | `netbird.io/v1alpha1` |
 | [Group](docs/api-reference.md#group) | `netbird.io/v1alpha1` |
-| [NetworkResource](docs/api-reference.md#networkresource) | `netbird.io/v1alpha1` |
 | [NetworkRouter](docs/api-reference.md#networkrouter) | `netbird.io/v1alpha1` |
-| [SetupKey](docs/api-reference.md#setupkey) | `netbird.io/v1alpha1` |
+| [NetworkResource](docs/api-reference.md#networkresource) | `netbird.io/v1alpha1` |
+| [NetworkEgress](docs/api-reference.md#networkegress) | `netbird.io/v1alpha1` |
 | [SidecarProfile](docs/api-reference.md#sidecarprofile) | `netbird.io/v1alpha1` |
 | [ClusterProxy](docs/api-reference.md#clusterproxy) | `netbird.io/v1alpha1` |

api/v1alpha1/networkegress_types.go

@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// NetworkEgressSpec defines the desired state of NetworkEgress.
+type NetworkEgressSpec struct {
+	// NetworkRouterRef is a reference to the network and router where the resource will be created.
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
+	NetworkRouterRef CrossNamespaceReference `json:"networkRouterRef"`
+
+	// Target for egress traffic.
+	Target NetworkEgressTarget `json:"target"`
+
+	// Ports to the resource to route.
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:Required
+	Ports []NetworkEgressPort `json:"ports"`
+}
+
+// NetworkEgressTarget describes a single allowed egress destination.
+// Exactly one of IP or FQDN must be set.
+// +kubebuilder:validation:XValidation:rule="(has(self.ip) ? 1 : 0) + (has(self.fqdn) ? 1 : 0) == 1",message="exactly one of ip or fqdn must be set"
+type NetworkEgressTarget struct {
+	// IP targets a single specific IP address (not a CIDR range).
+	// +optional
+	IP *NetworkEgressIPTarget `json:"ip,omitempty"`
+
+	// FQDN targets an exact domain name (no wildcards).
+	// +optional
+	FQDN *NetworkEgressFQDNTarget `json:"fqdn,omitempty"`
+}
+
+// NetworkEgressIPTarget is a single IPv4 or IPv6 address.
+type NetworkEgressIPTarget struct {
+	// Address is a single IP address.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:XValidation:rule="isIP(self)",message="address must be a valid IPv4 or IPv6 address"
+	Address string `json:"address"`
+}
+
+// NetworkEgressFQDNTarget matches traffic by an exact domain name (no wildcards).
+type NetworkEgressFQDNTarget struct {
+	// Hostname is a fully qualified domain name to match exactly.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$`
+	Hostname string `json:"hostname"`
+}
+
+type NetworkEgressPort struct {
+	// Name of the port.
+	// +required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=15
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
+	Name string `json:"name,omitempty"`
+
+	// The port that will be exposed by this service.
+	// +required
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=65535
+	Port int32 `json:"port"`
+}
+
+// NetworkEgressStatus defines the observed state of NetworkEgress.
+type NetworkEgressStatus struct {
+	// ObservedGeneration is the last reconciled generation.
+	// +optional
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+
+	// Conditions holds the conditions for the NetworkEgress.
+	// +listType=map
+	// +listMapKey=type
+	// +optional
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description=""
+
+// NetworkEgress is the Schema for the networkegresses API.
+type NetworkEgress struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// +required
+	Spec NetworkEgressSpec `json:"spec"`
+
+	// +kubebuilder:default={"observedGeneration":-1}
+	Status NetworkEgressStatus `json:"status,omitempty"`
+}
+
+// GetConditions returns the status conditions of the object.
+func (n *NetworkEgress) GetConditions() []metav1.Condition {
+	return n.Status.Conditions
+}
+
+// SetConditions sets the status conditions on the object.
+func (n *NetworkEgress) SetConditions(conditions []metav1.Condition) {
+	n.Status.Conditions = conditions
+}
+
+// +kubebuilder:object:root=true
+
+// NetworkEgressList contains a list of NetworkEgress
+type NetworkEgressList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitzero"`
+	Items           []NetworkEgress `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&NetworkEgress{}, &NetworkEgressList{})
+}