add Match(Ext-)Communities to RoutingPolicy & NXOS support

api/core/v1alpha1/groupversion_info.go

@@ -270,6 +270,10 @@ const (
 const (
 	// PrefixSetNotFoundReason indicates that a referenced PrefixSet was not found.
 	PrefixSetNotFoundReason = "PrefixSetNotFound"
+	// CommunitySetNotFoundReason indicates that a referenced CommunitySet was not found.
+	CommunitySetNotFoundReason = "CommunitySetNotFound"
+	// ExtCommunitySetNotFoundReason indicates that a referenced ExtCommunitySet was not found.
+	ExtCommunitySetNotFoundReason = "ExtCommunitySetNotFound"
 	// SecretNotFoundReason indicates that a referenced Secret was not found.
 	SecretNotFoundReason = "SecretNotFound"
 	// RemoteEndpointUnreachableReason indicates that the remote object storage endpoint is not reachable.

api/core/v1alpha1/routingpolicy_types.go

@@ -63,6 +63,14 @@ type PolicyConditions struct {
 	// MatchPrefixSet matches routes against a PrefixSet resource.
 	// +optional
 	MatchPrefixSet *PrefixSetMatchCondition `json:"matchPrefixSet,omitempty"`
+
+	// MatchCommunitySet matches routes against a CommunitySet resource.
+	// +optional
+	MatchCommunitySet *CommunitySetMatchCondition `json:"matchCommunitySet,omitempty"`
+
+	// MatchExtCommunitySet matches routes against an ExtCommunitySet resource.
+	// +optional
+	MatchExtCommunitySet *ExtCommunitySetMatchCondition `json:"matchExtCommunitySet,omitempty"`
 }
 
 // PrefixSetMatchCondition defines the condition for matching against a PrefixSet.
@@ -73,6 +81,47 @@ type PrefixSetMatchCondition struct {
 	PrefixSetRef LocalObjectReference `json:"prefixSetRef"`
 }
 
+// CommunitySetMatchCondition defines the condition for matching against a CommunitySet.
+type CommunitySetMatchCondition struct {
+	// CommunitySetRef references a CommunitySet in the same namespace.
+	// The CommunitySet must exist and belong to the same device.
+	// +required
+	CommunitySetRef LocalObjectReference `json:"communitySetRef"`
+
+	// MatchSetOptions defines how a route's communities are compared against the referenced set.
+	// ANY matches a route carrying at least one member of the set; ALL matches only a route
+	// carrying every member of the set.
+	// +optional
+	// +kubebuilder:default=ANY
+	MatchSetOptions MatchSetOptions `json:"matchSetOptions,omitempty"`
+}
+
+// ExtCommunitySetMatchCondition defines the condition for matching against an ExtCommunitySet.
+type ExtCommunitySetMatchCondition struct {
+	// ExtCommunitySetRef references an ExtCommunitySet in the same namespace.
+	// The ExtCommunitySet must exist and belong to the same device.
+	// +required
+	ExtCommunitySetRef LocalObjectReference `json:"extCommunitySetRef"`
+
+	// MatchSetOptions defines how a route's extended communities are compared against the referenced set.
+	// ANY matches a route carrying at least one member of the set; ALL matches only a route
+	// carrying every member of the set.
+	// +optional
+	// +kubebuilder:default=ANY
+	MatchSetOptions MatchSetOptions `json:"matchSetOptions,omitempty"`
+}
+
+// MatchSetOptions defines how a route's attributes are compared against a referenced set.
+// +kubebuilder:validation:Enum=ANY;ALL
+type MatchSetOptions string
+
+const (
+	// MatchSetOptionsAny matches a route carrying at least one member of the referenced set.
+	MatchSetOptionsAny MatchSetOptions = "ANY"
+	// MatchSetOptionsAll matches only a route carrying every member of the referenced set.
+	MatchSetOptionsAll MatchSetOptions = "ALL"
+)
+
 // PolicyActions defines the actions to take when a policy statement matches.
 // +kubebuilder:validation:XValidation:rule="self.routeDisposition == 'AcceptRoute' || !has(self.bgpActions)",message="bgpActions cannot be specified when routeDisposition is RejectRoute"
 type PolicyActions struct {

config/samples/v1alpha1_routingpolicy.yaml

@@ -72,6 +72,21 @@ spec:
         bgpActions:
           setASPath:
             asNumber: 65000
+    - sequence: 80
+      conditions:
+        matchCommunitySet:
+          communitySetRef:
+            name: communityset
+          matchSetOptions: ALL
+      actions:
+        routeDisposition: AcceptRoute
+    - sequence: 90
+      conditions:
+        matchExtCommunitySet:
+          extCommunitySetRef:
+            name: extcommunityset
+      actions:
+        routeDisposition: AcceptRoute
     - sequence: 100
       actions:
         routeDisposition: AcceptRoute
@@ -129,3 +144,37 @@ spec:
       maskLengthRange:
         min: 25
         max: 32
+---
+apiVersion: networking.metal.ironcore.dev/v1alpha1
+kind: CommunitySet
+metadata:
+  labels:
+    app.kubernetes.io/name: network-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: communityset-rp
+spec:
+  deviceRef:
+    name: leaf1
+  name: WIREAPI
+  members:
+    - sequence: 5
+      regex: "50000:[0-9][0-9]"
+    - sequence: 10
+      regex: "65001:[0-9]+"
+---
+apiVersion: networking.metal.ironcore.dev/v1alpha1
+kind: ExtCommunitySet
+metadata:
+  labels:
+    app.kubernetes.io/name: network-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: extcommunityset-rp
+spec:
+  deviceRef:
+    name: leaf1
+  name: WIREAPI
+  members:
+    - sequence: 5
+      regex: "65200:[0-9][0-9]"
+    - sequence: 15
+      regex: "65300:[0-9]+"