[feat] VLAN support for CAPL clusters

api/v1alpha1/conversion.go

@@ -86,3 +86,8 @@ func Convert_v1alpha2_LinodeObjectStorageBucket_To_v1alpha1_LinodeObjectStorageB
 	}
 	return autoConvert_v1alpha2_LinodeObjectStorageBucket_To_v1alpha1_LinodeObjectStorageBucket(in, out, scope)
 }
+
+func Convert_v1alpha2_LinodeClusterSpec_To_v1alpha1_LinodeClusterSpec(in *infrastructurev1alpha2.LinodeClusterSpec, out *LinodeClusterSpec, scope conversion.Scope) error {
+	// VLAN is not supported in v1alpha1
+	return autoConvert_v1alpha2_LinodeClusterSpec_To_v1alpha1_LinodeClusterSpec(in, out, scope)
+}

api/v1alpha2/linodecluster_types.go

@@ -148,6 +148,11 @@ type NetworkSpec struct {
 	// additionalPorts contains list of ports to be configured with NodeBalancer.
 	// +optional
 	AdditionalPorts []LinodeNBPortConfig `json:"additionalPorts,omitempty"`
+
+	// UseVlan provisions a cluster that uses VLANs instead of VPCs. IPAM is managed internally.
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
+	// +optional
+	UseVlan bool `json:"useVlan"`
 }
 
 type LinodeNBPortConfig struct {

api/v1alpha2/linodecluster_webhook.go

@@ -106,6 +106,13 @@
 		}
 	}
 
+	if r.Spec.Network.UseVlan && r.Spec.VPCRef != nil {
+		errs = append(errs, &field.Error{
+			Field: "Cannot use VLANs and VPCs together. Unset `network.useVlan` or remove `vpcRef`",
+			Type:  field.ErrorTypeInvalid,
+		})
+	}
+
 	if len(errs) == 0 {
 		return nil
 	}

config/crd/bases/infrastructure.cluster.x-k8s.io_linodeclusters.yaml

@@ -403,6 +403,13 @@ spec:
                   nodeBalancerID:
                     description: NodeBalancerID is the id of NodeBalancer.
                     type: integer
+                  useVlan:
+                    description: UseVlan provisions a cluster that uses VLANs instead
+                      of VPCs. IPAM is managed internally.
+                    type: boolean
+                    x-kubernetes-validations:
+                    - message: Value is immutable
+                      rule: self == oldSelf
                 type: object
               region:
                 description: The Linode Region the LinodeCluster lives in.

config/crd/bases/infrastructure.cluster.x-k8s.io_linodeclustertemplates.yaml

@@ -331,6 +331,13 @@ spec:
                           nodeBalancerID:
                             description: NodeBalancerID is the id of NodeBalancer.
                             type: integer
+                          useVlan:
+                            description: UseVlan provisions a cluster that uses VLANs
+                              instead of VPCs. IPAM is managed internally.
+                            type: boolean
+                            x-kubernetes-validations:
+                            - message: Value is immutable
+                              rule: self == oldSelf
                         type: object
                       region:
                         description: The Linode Region the LinodeCluster lives in.

config/rbac/role.yaml

@@ -4,6 +4,17 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - ""
   resources:

controller/linodecluster_controller.go

@@ -220,7 +220,7 @@
 	return nil
 }
 
 func (r *LinodeClusterReconciler) reconcileDelete(ctx context.Context, logger logr.Logger, clusterScope *scope.ClusterScope) error {
 	logger.Info("deleting cluster")
 	switch {
 	case clusterScope.LinodeCluster.Spec.Network.LoadBalancerType == "external":
@@ -262,6 +262,20 @@
 		return errors.New("waiting for associated LinodeMachine objects to be deleted")
 	}
 
+	if clusterScope.LinodeCluster.Spec.Network.UseVlan {
+		var ipsMap corev1.ConfigMap
+		err := clusterScope.Client.Get(ctx, client.ObjectKey{Namespace: clusterScope.Cluster.Namespace, Name: fmt.Sprintf("%s-ips", clusterScope.Cluster.Name)}, &ipsMap)
+		if err != nil && !apierrors.IsNotFound(err) {
+			logger.Error(err, "failed to get ips configmap")
+			return err
+		}
+		err = clusterScope.Client.Delete(ctx, &ipsMap)
+		if err != nil && !apierrors.IsNotFound(err) {
+			logger.Error(err, "failed to delete ips configmap")
+			return err
+		}
+	}
+
 	if err := clusterScope.RemoveCredentialsRefFinalizer(ctx); err != nil {
 		logger.Error(err, "failed to remove credentials finalizer")
 		setFailureReason(clusterScope, cerrs.DeleteClusterError, err, r)

controller/linodemachine_controller.go

@@ -101,6 +101,7 @@ type LinodeMachineReconciler struct {
 // +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machines,verbs=get;watch;list
 // +kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="",resources=secrets;,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=configmaps;,verbs=get;watch;list;create;update;patch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.

controller/linodemachine_controller_helpers.go

@@ -24,15 +24,19 @@
 	"errors"
 	"fmt"
 	"net/http"
+	"net/netip"
 	"slices"
 	"sort"
 
 	"github.com/go-logr/logr"
 	"github.com/google/uuid"
 	"github.com/linode/linodego"
+	"golang.org/x/exp/maps"
+	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/util/retry"
 	"k8s.io/utils/ptr"
 	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
 	cerrs "sigs.k8s.io/cluster-api/errors"
@@ -51,7 +55,11 @@
 
 // Size limit in bytes on the decoded metadata.user_data for cloud-init
 // The decoded user_data must not exceed 16384 bytes per the Linode API
-const maxBootstrapDataBytes = 16384
+const (
+	maxBootstrapDataBytes = 16384
+	vlanIPRange           = "10.0.0.0/8"
+	vlanIPFormat          = "%s/11"
+)
 
 var (
 	errNoPublicIPv4Addrs      = errors.New("no public ipv4 addresses set")
@@ -80,24 +88,7 @@
 	return ctrl.Result{}, err
 }
 
-func newCreateConfig(ctx context.Context, machineScope *scope.MachineScope, logger logr.Logger) (*linodego.InstanceCreateOptions, error) {
-	var err error
-
-	createConfig := linodeMachineSpecToInstanceCreateConfig(machineScope.LinodeMachine.Spec)
-	if createConfig == nil {
-		err = errors.New("failed to convert machine spec to create instance config")
-
-		logger.Error(err, "Panic! Struct of LinodeMachineSpec is different than InstanceCreateOptions")
-
-		return nil, err
-	}
-
-	createConfig.Booted = util.Pointer(false)
-
-	if err := setUserData(ctx, machineScope, createConfig, logger); err != nil {
-		return nil, err
-	}
-
+func fillCreateConfig(createConfig *linodego.InstanceCreateOptions, machineScope *scope.MachineScope) {
 	if machineScope.LinodeMachine.Spec.PrivateIP != nil {
 		createConfig.PrivateIP = *machineScope.LinodeMachine.Spec.PrivateIP
 	} else {
@@ -119,8 +110,28 @@
 	if createConfig.RootPass == "" {
 		createConfig.RootPass = uuid.NewString()
 	}
+}
+
+func newCreateConfig(ctx context.Context, machineScope *scope.MachineScope, logger logr.Logger) (*linodego.InstanceCreateOptions, error) {
+	var err error
+
+	createConfig := linodeMachineSpecToInstanceCreateConfig(machineScope.LinodeMachine.Spec)
+	if createConfig == nil {
+		err = errors.New("failed to convert machine spec to create instance config")
+
+		logger.Error(err, "Panic! Struct of LinodeMachineSpec is different than InstanceCreateOptions")
+
+		return nil, err
+	}
 
-	// if vpc, attach additional interface as eth0 to linode
+	createConfig.Booted = util.Pointer(false)
+	if err := setUserData(ctx, machineScope, createConfig, logger); err != nil {
+		return nil, err
+	}
+
+	fillCreateConfig(createConfig, machineScope)
+
+	// if vpc is enabled, attach additional interface as eth0 to linode
 	if machineScope.LinodeCluster.Spec.VPCRef != nil {
 		iface, err := getVPCInterfaceConfig(ctx, machineScope, createConfig.Interfaces, logger)
 		if err != nil {
@@ -134,6 +145,19 @@
 		}
 	}
 
+	// if vlan is enabled, attach additional interface as eth0 to linode
+	if machineScope.LinodeCluster.Spec.Network.UseVlan {
+		iface, err := getVlanInterfaceConfig(ctx, machineScope, logger)
+		if err != nil {
+			logger.Error(err, "Failed to get VLAN interface config")
+			return nil, err
+		}
+		if iface != nil {
+			// add VLAN interface as first interface
+			createConfig.Interfaces = slices.Insert(createConfig.Interfaces, 0, *iface)
+		}
+	}
+
 	if machineScope.LinodeMachine.Spec.PlacementGroupRef != nil {
 		pgID, err := getPlacementGroupID(ctx, machineScope, logger)
 		if err != nil {
@@ -191,14 +215,22 @@
 		Type:    clusterv1.MachineExternalIP,
 	})
 
-	// Iterate over interfaces in config and find VPC specific ips
+	// Iterate over interfaces in config and find VPC or VLAN specific ips
 	for _, iface := range configs[0].Interfaces {
 		if iface.VPCID != nil && iface.IPv4.VPC != "" {
 			ips = append(ips, clusterv1.MachineAddress{
 				Address: iface.IPv4.VPC,
 				Type:    clusterv1.MachineInternalIP,
 			})
 		}
+
+		if iface.Purpose == linodego.InterfacePurposeVLAN {
+			// vlan addresses have a /11 appended to them - we should strip it out.
+			ips = append(ips, clusterv1.MachineAddress{
+				Address: netip.MustParsePrefix(iface.IPAMAddress).Addr().String(),
+				Type:    clusterv1.MachineInternalIP,
+			})
+		}
 	}
 
 	// if a node has private ip, store it as well
@@ -345,6 +377,95 @@
 	return *linodeFirewall.Spec.FirewallID, nil
 }
 
+func getNextIP(ips []string, prefixStr string) string {
+	prefix := netip.MustParsePrefix(prefixStr)
+	currentIp := prefix.Addr().Next()
+
+	ipString := currentIp.String()
+	for {
+		if !slices.Contains(ips, ipString) {
+			break
+		}
+		currentIp = currentIp.Next()
+		ipString = currentIp.String()
+	}
+	return ipString
+}
+
+func createIPsConfigMap(ctx context.Context, machineScope *scope.MachineScope, ip string) error {
+	return machineScope.Client.Create(ctx, &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      fmt.Sprintf("%s-ips", machineScope.Cluster.Name),
+			Namespace: machineScope.Cluster.Namespace,
+			Labels: map[string]string{
+				"clusterctl.cluster.x-k8s.io/move": "true",
+			},
+		},
+		Data: map[string]string{
+			machineScope.LinodeMachine.Name: ip,
+		},
+	})
+}
+
+func reserveNextIP(ctx context.Context, machineScope *scope.MachineScope, logger logr.Logger) (string, error) {
+	namespace := machineScope.Cluster.Namespace
+	clusterName := machineScope.Cluster.Name
+	var nextIP string
+	var ipsMap corev1.ConfigMap
+	err := machineScope.Client.Get(ctx, client.ObjectKey{Namespace: namespace, Name: fmt.Sprintf("%s-ips", clusterName)}, &ipsMap)
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			nextIP = getNextIP([]string{}, vlanIPRange)
+			if err := createIPsConfigMap(ctx, machineScope, nextIP); err != nil {
+				return "", fmt.Errorf("creating Ips configmap: %w", err)
+			}
+			logger.Info("Machine got ip", machineScope.LinodeMachine.Name, nextIP)
+			return fmt.Sprintf(vlanIPFormat, nextIP), nil
+		}
+		return "", fmt.Errorf("retreiving ips configmap %s/%s: %w", namespace, fmt.Sprintf("%s-ips", clusterName), err)
+	}
+
+	if ip, ok := ipsMap.Data[machineScope.LinodeMachine.Name]; ok {
+		return fmt.Sprintf(vlanIPFormat, ip), nil
+	}
+
+	err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		if err := machineScope.Client.Get(ctx, client.ObjectKeyFromObject(&ipsMap), &ipsMap); err != nil {
+			return err
+		}
+
+		nextIP = getNextIP(maps.Values(ipsMap.Data), vlanIPRange)
+		ipsMap.Data[machineScope.LinodeMachine.Name] = nextIP
+		if err := machineScope.Client.Update(ctx, &ipsMap); err != nil {
+			return err
+		}
+		return nil
+	})
+	if err != nil {
+		return "", fmt.Errorf("updating ips in configmap %s/%s: %w", namespace, fmt.Sprintf("%s-ips", clusterName), err)
+	}
+
+	logger.Info("onbtained IP for machine", "name", machineScope.LinodeMachine.Name, "ip", nextIP)
+	return fmt.Sprintf(vlanIPFormat, nextIP), nil
+}
+
+func getVlanInterfaceConfig(ctx context.Context, machineScope *scope.MachineScope, logger logr.Logger) (*linodego.InstanceConfigInterfaceCreateOptions, error) {
+	logger = logger.WithValues("vlanName", machineScope.Cluster.Name)
+
+	// Try to obtain a IP for the machine using its name
+
+	ip, err := reserveNextIP(ctx, machineScope, logger)
+	if err != nil {
+		return nil, err
+	}
+
+	return &linodego.InstanceConfigInterfaceCreateOptions{
+		Purpose:     linodego.InterfacePurposeVLAN,
+		Label:       machineScope.Cluster.Name,
+		IPAMAddress: ip,
+	}, nil
+}
+
 func getVPCInterfaceConfig(ctx context.Context, machineScope *scope.MachineScope, interfaces []linodego.InstanceConfigInterfaceCreateOptions, logger logr.Logger) (*linodego.InstanceConfigInterfaceCreateOptions, error) {
 	name := machineScope.LinodeCluster.Spec.VPCRef.Name
 	namespace := machineScope.LinodeCluster.Spec.VPCRef.Namespace