Add support for "Isolated" AccessMode in Subnet configuration #1183

zhengxiexie · 2025-07-31T04:08:16Z

✨ What's Changed

Add support for 'Isolated' AccessMode in Subnet configuration
Update kubebuilder validation enum to include new 'Isolated' option
Add test coverage for mapping NSX Subnet with Isolated AccessMode
Clean up minor code formatting and documentation improvements

🎯 Motivation

The current Subnet API only supports three AccessMode types: 'Private', 'Public', and 'PrivateTGW'. There is a need to support 'Isolated' AccessMode for specific network segmentation requirements where subnets need to be completely isolated from other network segments.

This enhancement provides:

Enhanced Network Segmentation: Allow creation of completely isolated subnets
Infrastructure Alignment: Match NSX-T capabilities for isolated networking
Flexibility: Give users more options for network design patterns

✅ Testing

All existing unit tests pass
New test case added for 'Isolated' AccessMode mapping
Updated controller tests to use proper type casting for AccessMode
Validates that NSX Subnet with 'Isolated' access mode correctly maps to v1alpha1.Subnet

🔧 Technical Details

Before: Subnet AccessMode was limited to three options

// +kubebuilder:validation:Enum=Private;Public;PrivateTGW

After: Added 'Isolated' as a fourth option

// +kubebuilder:validation:Enum=Private;Public;PrivateTGW;Isolated
const AccessModeIsolated string = "Isolated"

Key Changes:

Added AccessModeIsolated constant in subnet_types.go
Updated kubebuilder validation enum to include 'Isolated'
Enhanced NSX-to-CR mapping logic to handle 'Isolated' AccessMode
Added comprehensive test coverage for the new AccessMode
Fixed minor formatting issues and improved documentation clarity

📎 Additional Notes

Zero risk change - purely additive functionality
Maintains backward compatibility with existing AccessMode values
No API breaking changes
Aligns with NSX-T subnet isolation capabilities
Ready for immediate use in network configurations requiring isolation

zhengxiexie · 2025-07-31T04:15:33Z

/e2e

codecov-commenter · 2025-07-31T04:24:05Z

Codecov Report

❌ Patch coverage is 76.47059% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.81%. Comparing base (051011c) to head (3518096).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/nsx/services/subnet/subnet.go	62.50%	3 Missing ⚠️
pkg/nsx/services/subnet/builder.go	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1183   +/-   ##
=======================================
  Coverage   73.81%   73.81%           
=======================================
  Files         141      141           
  Lines       22350    22359    +9     
=======================================
+ Hits        16498    16505    +7     
- Misses       4829     4830    +1     
- Partials     1023     1024    +1

Flag	Coverage Δ
unit-tests	`73.81% <76.47%> (+<0.01%)`	⬆️

Files with missing lines	Coverage Δ
pkg/util/utils.go	`85.29% <100.00%> (+0.09%)`	⬆️
pkg/nsx/services/subnet/builder.go	`91.17% <66.66%> (ø)`
pkg/nsx/services/subnet/subnet.go	`74.00% <62.50%> (+0.50%)`	⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

zhengxiexie · 2025-07-31T04:25:44Z

/e2e

zhengxiexie · 2025-07-31T04:53:33Z

/e2e

zhengxiexie · 2025-07-31T06:01:12Z

/e23

zhengxiexie · 2025-07-31T06:01:16Z

/e2e

zhengxiexie · 2025-07-31T06:39:01Z

/e2e

zhengxiexie · 2025-07-31T06:54:54Z

/e2e

zhengxiexie · 2025-07-31T07:18:53Z

/e2e

yanjunz97 · 2025-07-31T07:46:38Z

pkg/apis/vpc/v1alpha1/subnet_types.go

 }

-// Additional DHCP server config for a VPC Subnet.
+// DHCPServerAdditionalConfig Additional DHCP server config for a VPC Subnet.


Suggested change

// DHCPServerAdditionalConfig Additional DHCP server config for a VPC Subnet.

// DHCPServerAdditionalConfig defines the additional DHCP server config for a VPC Subnet.

yanjunz97 · 2025-07-31T07:47:12Z

pkg/apis/vpc/v1alpha1/subnet_types.go

 	AccessModePublic              string            = "Public"
 	AccessModePrivate             string            = "Private"
 	AccessModeProject             string            = "PrivateTGW"
+	AccessModeIsolated            string            = "Isolated"


Not introduced in this PR, would you think we can use AccessMode instead of string here?

ok, updated

yanjunz97 · 2025-07-31T07:49:35Z

pkg/apis/vpc/v1alpha1/subnet_types.go

 	IPv4SubnetSize int `json:"ipv4SubnetSize,omitempty"`
 	// Access mode of Subnet, accessible only from within VPC or from outside VPC.
-	// +kubebuilder:validation:Enum=Private;Public;PrivateTGW
+	// +kubebuilder:validation:Enum=Private;Public;PrivateTGW;Isolated


Could you run make manifests and make generate-api-docs?

yanjunz97 · 2025-07-31T07:56:36Z

pkg/apis/vpc/v1alpha1/subnet_types.go

 	IPv4SubnetSize int `json:"ipv4SubnetSize,omitempty"`
 	// Access mode of Subnet, accessible only from within VPC or from outside VPC.
-	// +kubebuilder:validation:Enum=Private;Public;PrivateTGW
+	// +kubebuilder:validation:Enum=Private;Public;PrivateTGW;Isolated


Would you know if we would like to support Isolated AccessMode for Subnetset?

zhengxiexie · 2025-08-04T04:46:53Z

/e2e

zhengxiexie · 2025-08-04T05:02:52Z

/e2e

pkg/apis/vpc/v1alpha1/subnet_types.go

pkg/util/utils.go

zhengxiexie · 2025-08-05T05:15:47Z

/e2e

Signed-off-by: Xie Zheng <[email protected]>

yanjunz97

LGTM

lxiaopei · 2025-08-07T02:38:34Z

from NSX API doc https://github-vcf.devops.broadcom.net/vcf/nsx/blob/nsx-main/mp/policy/policy-api/src/main/resources/api_spec/root/nsx-policy/policy-vpc-subnet.yml#L219. "Isolated - VPC Subnet is not accessible from other VPC Subnets within the same VPC.
Please make use of Private, Private_TGW or Public Subnets with connectivity_state as DISCONNECTED to have a disconnected Subnet.
This value is deprecated." "Isolated" access mode is deprecated, I think we do not need to add new access mode "Isolated" in Subnet CR, but indicate user to use "connectivity_state as DISCONNECTED". WDYT?

yanjunz97 reviewed Jul 31, 2025

View reviewed changes

zhengxiexie force-pushed the topic/zhengxie/main/isolated_subnet_type branch from 55df814 to ea64b48 Compare August 1, 2025 08:16

yanjunz97 reviewed Aug 4, 2025

View reviewed changes

pkg/apis/vpc/v1alpha1/subnet_types.go Show resolved Hide resolved

pkg/util/utils.go Outdated Show resolved Hide resolved

zhengxiexie force-pushed the topic/zhengxie/main/isolated_subnet_type branch from ea64b48 to e6c523e Compare August 5, 2025 03:42

zhengxiexie force-pushed the topic/zhengxie/main/isolated_subnet_type branch from e6c523e to 295f95f Compare August 6, 2025 02:21

Add support for "Isolated" AccessMode in Subnet configuration

3518096

Signed-off-by: Xie Zheng <[email protected]>

zhengxiexie force-pushed the topic/zhengxie/main/isolated_subnet_type branch from 295f95f to 3518096 Compare August 6, 2025 02:25

yanjunz97 approved these changes Aug 6, 2025

View reviewed changes

	// DHCPServerAdditionalConfig Additional DHCP server config for a VPC Subnet.
	// DHCPServerAdditionalConfig defines the additional DHCP server config for a VPC Subnet.

Add support for "Isolated" AccessMode in Subnet configuration #1183

Are you sure you want to change the base?

Add support for "Isolated" AccessMode in Subnet configuration #1183

Uh oh!

Conversation

zhengxiexie commented Jul 31, 2025

✨ What's Changed

🎯 Motivation

✅ Testing

🔧 Technical Details

📎 Additional Notes

Uh oh!

zhengxiexie commented Jul 31, 2025

Uh oh!

codecov-commenter commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zhengxiexie commented Jul 31, 2025

Uh oh!

zhengxiexie commented Jul 31, 2025

Uh oh!

zhengxiexie commented Jul 31, 2025

Uh oh!

zhengxiexie commented Jul 31, 2025

Uh oh!

zhengxiexie commented Jul 31, 2025

Uh oh!

zhengxiexie commented Jul 31, 2025

Uh oh!

zhengxiexie commented Jul 31, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zhengxiexie commented Aug 4, 2025

Uh oh!

zhengxiexie commented Aug 4, 2025

Uh oh!

Uh oh!

Uh oh!

zhengxiexie commented Aug 5, 2025

Uh oh!

yanjunz97 left a comment

Choose a reason for hiding this comment

Uh oh!

lxiaopei commented Aug 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov-commenter commented Jul 31, 2025 •

edited

Loading