Decouple VyOS integration from network namespace in tenant-space

[HiranAdikari]

Summary

• vlan_id alone now creates network namespace + harvester_network — no VyOS required (physical switch / manually configured VLAN environments)
• New create_network_namespace flag (default: false) pre-provisions the <project_name>-net namespace before a VLAN is assigned
• vlan_id + vyos_endpoint additionally configures VyOS vif/DHCP/NAT
• Fixes harvester_network ownership collision: moved from vyos-tenant into tenant-space so both modules no longer create the same resource simultaneously
• harvester_network depends_on module.vyos_tenant — VyOS vif committed before network is visible to VMs
• Fixes namespaces local to use distinct(concat([project_name], namespaces)) so the project namespace is always included
• Adds network_namespace_id output
• subnet_cidr / gateway_ip outputs now derive from locals directly rather than routing through vyos-tenant module
• Labels the network namespace with platform.wso2.com/role=network-namespace (used by reconciler in Add namespace credential provisioner module #62 to skip it)
• route_mode is now "auto" when vyos_endpoint is not set — upstream router handles DHCP/routing for externally managed VLANs; "manual" with deterministic 10.0.0.0/8 subnetting only when VyOS is configured (closes Support auto route mode for manually configured VLAN networks in tenant-space #65)
• Relaxed vlan_id validation from >= 1000 to the full 802.1Q range (1–4094)

Behaviour matrix

create_network_namespace	vlan_id	vyos_endpoint	Result
false	null	—	No network resources
true	null	—	Network namespace only
false/true	set	null	Network namespace + harvester_network (route_mode=auto)
false/true	set	set	Network namespace + harvester_network (route_mode=manual) + VyOS config

Backward compatibility

Existing callers without vlan_id: no change (new flag defaults to false).

Existing callers with vlan_id set: harvester_network moves from address
module.<name>.module.vyos_tenant[0].harvester_network.tenant to
module.<name>.harvester_network.tenant[0]. A targeted import is needed on
first apply against an environment that previously applied with VyOS:

terraform import 'module.<name>.harvester_network.tenant[0]' <namespace>/<name>

New environments (no prior state) are unaffected.

Test plan

• create_network_namespace = true, no vlan_id → only <name>-net namespace created
• vlan_id set, no vyos_endpoint → namespace + harvester_network with route_mode=auto, no VyOS API calls
• vlan_id + vyos_endpoint → full stack: namespace + network (route_mode=manual) + VyOS vif/DHCP/NAT
• Existing caller with no vlan_id → zero plan diff
• vlan_id below 1000 accepted when vyos_endpoint not set

Closes #63
Closes #65

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ac777f6e-976c-4a14-8d42-6aa4b9d721e2

📥 Commits

Reviewing files that changed from the base of the PR and between 5c35e89 and ff993f3.

📒 Files selected for processing (9)

• modules/management/tenant-space/.terraform.lock.hcl
• modules/management/tenant-space/main.tf
• modules/management/tenant-space/outputs.tf
• modules/management/tenant-space/variables.tf
• modules/management/tenant-space/versions.tf
• modules/network/vyos-tenant/main.tf
• modules/network/vyos-tenant/outputs.tf
• modules/network/vyos-tenant/variables.tf
• modules/network/vyos-tenant/versions.tf

---

Summary

This pull request decouples VyOS integration from network namespace and harvester network creation in the tenant-space module, enabling VLAN-based network configuration independent of VyOS availability.

Key Changes

Networking Independence: The module now treats VLAN configuration (vlan_id) and VyOS management (vyos_endpoint) as independent options. Setting vlan_id alone creates the network namespace and harvester network; VyOS is only invoked when both vlan_id and vyos_endpoint are specified.

Resource Ownership Reorganization: The harvester_network resource is moved from the vyos-tenant module to tenant-space, making the module responsible for all network resource creation while vyos-tenant focuses solely on VyOS-specific configuration (vif sub-interface, DHCP, and NAT).

Expanded Configuration Options: A new create_network_namespace variable enables pre-provisioning the network namespace before VLAN assignment. The vlan_id validation range is expanded from a fixed floor (≥1000) to the full 802.1Q standard range (1–4094).

Adaptive Routing Behavior: Routing mode now adapts based on VyOS availability:

• When VyOS is configured: route_mode = "manual" with deterministic /23 subnets from the 10.0.0.0/8 range
• When VyOS is not configured: route_mode = "auto" with upstream DHCP/routing handling

Output Refinements: A new network_namespace_id output is added; subnet_cidr and gateway_ip outputs now derive from computed locals rather than VyOS module outputs, functioning independently of VyOS availability.

Code Quality: Namespace deduplication logic is corrected to ensure the project namespace is always included; network namespaces receive platform labeling (platform.wso2.com/role=network-namespace).

Backward Compatibility

Deployments without vlan_id remain unchanged. Existing deployments using VyOS require a targeted import of the moved harvester_network resource on the first apply to maintain state consistency.

Walkthrough

The PR decouples VyOS integration from network namespace and harvester network creation in the tenant-space module. The harvester_network resource is moved from vyos-tenant into tenant-space, and routing behavior is split: auto mode when VyOS is absent, manual deterministic mode when VyOS endpoint is configured. VLAN validation is relaxed to the full 802.1Q range.

Changes

Cohort / File(s)	Summary
Tenant-space configuration modules/management/tenant-space/main.tf, modules/management/tenant-space/outputs.tf, modules/management/tenant-space/variables.tf, modules/management/tenant-space/versions.tf, modules/management/tenant-space/.terraform.lock.hcl	Introduces create_net_ns and use_vyos control locals; moves harvester_network.tenant creation from vyos-tenant module; implements conditional routing (auto when vyos_endpoint=null, manual with deterministic /23 subnet when set); adds network_namespace_id output; relaxes vlan_id validation to 802.1Q range (1–4094); removes vyos provider requirement.
VyOS-tenant module refactor modules/network/vyos-tenant/main.tf, modules/network/vyos-tenant/outputs.tf, modules/network/vyos-tenant/variables.tf, modules/network/vyos-tenant/versions.tf	Removes harvester_network.tenant resource and harvester provider; removes network_namespace and cluster_network_name inputs; removes network-related outputs (network_name, network_namespace, network_ref); adds lifecycle { ignore_changes = [section] } to DHCP config block.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Add VyOS multi-tenant gateway modules #38: Originally added harvester_network resource in vyos-tenant module; this PR removes it and shifts creation responsibility to tenant-space module.

Suggested reviewers

• gnudeep

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}