Add support for the neutron-fwaas plugin

[slawqo]

This patch adds "enableFwaas" flag to the Neutron CRD. Setting this flag to True will enable firewall_v2 service plugin and configure OVN service provider for the FIREWALL_V2 resource if OVN mechanism driver is used.

Closes: #OSPRH-15214

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: slawqo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [slawqo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[slawqo]

This is now just draft as we first need to have neutron-fwaas available in the NeutronAPI container image.

[stuggi]

if this is only setting config values, shouldn't this be a docs thing on how to use the custom service override to configure it? we intended to not add tht like parameters to just set config values. if there is deployment related changes required based on the switch its ok to add.

[slawqo]

if this is only setting config values, shouldn't this be a docs thing on how to use the custom service override to configure it? we intended to not add tht like parameters to just set config values. if there is deployment related changes required based on the switch its ok to add.

It is not handled in this PR yet but in case when neutron-fwaas was enabled in the existing deployment we should run neutron-db-manage script to update database and create fwaas tables. I think that this may be easier that way rather then parsing customServiceConfig and looking for the service_plugins there.

Also I think that it may be nicer user experience to just set such one flag to True rather then ask users to configure e.g. service_providers for fwaas.

The other way we could do that is maybe add variable for service_plugins - similarly to what we have for mechanism_drivers already and then it would be easier to check if firewall_v2 is enabled there or not.