feat(api): make network.id optional and implement network creation by fabian-schmitt · Pull Request #34 · stackitcloud/cluster-api-provider-stackit

fabian-schmitt · 2026-10-15T11:41:45Z

Description

This PR implements support for managed network creation in StackitCluster, resolving #9.

Previously, StackitCluster and StackitMachine required a pre-existing STACKIT network ID (.spec.network.id). This PR makes .spec.network.id optional, introducing two operational modes:

Managed Mode (omitted spec.network.id):
- Automatically provisions a dedicated /24 STACKIT network named <cluster-name>-network.
- Tags the network with canonical Cluster API tags (cluster.x-k8s.io/cluster-name, managed-by, etc.).
- Stores { id: "<uuid>", managed: true } in status.network.
- On cluster teardown: Deletes the managed network after machines, load balancers, and bastions are removed. If ports/interfaces are still detaching (409 Conflict), requeues with a NetworkInUse condition and warning event. If status was lost during deletion, falls back to tag-based discovery.
Bring-Your-Own (BYO) Mode (provided spec.network.id):
- Validates that the network exists and records { id: "<uuid>", managed: false } in status.network.
- Leaves the network untouched on cluster deletion.

Key Changes

API & CRDs (api/v1alpha1/, config/crd/):
- Made .spec.network and .spec.network.id optional in StackitCluster, StackitMachine, and their templates.
- Added Status.Network (StackitNetworkStatus{ id, managed }) to StackitClusterStatus.
- Updated kubectl printcolumn for Network ID to read from .status.network.id (works for both BYO and managed clusters).
Webhook Validation (webhook/v1alpha1/):
- Allowed empty network IDs on create.
- Enforced immutability: prevents changing .spec.network.id or switching between managed and BYO after creation.
Cloud Client & Abstraction (cloud/):
- Added CreateNetworkInput{ Name, IPv4Prefix, Tags }.
- Added CreateNetwork, DeleteNetwork, FindNetworkByTags, and ListNetworksByTags to cloud.Client, SDKClient, and cloudfake.Client.
- Implemented tag-based idempotency in CreateNetwork to avoid duplicate networks across reconcile retries.
- Updated cloud.CleanupByTags to clean up managed networks in E2E environments.
Scope & Service Layer (scope/, cloud/services/):
- Created cloud/services/network/network.go for network input assembly and tag generation.
- Added MachineScope.NetworkID() and ClusterScope.NetworkID() for encapsulated fallback resolution (Machine Spec -> Cluster Spec -> Cluster Status).
- Updated API server load balancer and bastion services to receive the resolved networkID.
Reconciliation & Teardown (controller/):
- Updated reconcileNormal to provision or adopt managed networks and set ClusterNetworkReadyCondition.
- Updated reconcileDelete to delete managed networks, handling 409 Conflict requeues gracefully.
- Updated machine provisioning to use the resolved network ID.
Tests & Documentation (*_test.go, docs/):
- Added unit tests for webhook validation, SDK client network creation/deletion, service input generation, scope fallback resolution, and controller reconciliation/deletion.
- Updated docs/src/getting-started/cloud-resources.md.

Testing

Verified all unit and controller tests pass:
```
make test
```
Verified code formatting and linter checks pass with zero issues:
```
make lint-fix
```

ToDo or at least to discuss

Cluster-template changes: Should we now default to empty network?
LoadBalancer NetworkID:
@ templates/cluster-template.yaml#L288-294
How to handle the STACKIT_NETWORK_ID in the cloud.yaml in the generated secret?
Should a controller patch or generate the value after the network is generated?

…d networks

tuunit · 2026-10-23T11:47:51Z

 	stackitCluster := clusterScope.StackitCluster
-	input := bastionservice.Input(stackitCluster, nil)
+	input := bastionservice.Input(stackitCluster, clusterScope.NetworkID(), nil)


i think we should rather provide the cluster scope to the bastion input and call clusterScope.NetworkID() inside of the input method

tuunit · 2026-10-23T11:48:56Z

 )

-func Input(stackitCluster *infrav1.StackitCluster, cloudInit []byte) cloud.BastionInput {
+func Input(stackitCluster *infrav1.StackitCluster, networkID string, cloudInit []byte) cloud.BastionInput {


as in my comment further below we should change this method signature to use the clusterScope as an input

pseudo code:

Suggested change

func Input(stackitCluster *infrav1.StackitCluster, networkID string, cloudInit []byte) cloud.BastionInput {

func Input(cluster *scope.ClusterScope, cloudInit []byte) cloud.BastionInput {

tuunit · 2026-10-23T11:49:38Z

 func APIServerInput(
 	stackitCluster *infrav1.StackitCluster,
+	networkID string,
 	targets []cloud.LoadBalancerTargetInput,


same as for the bastion input, provide the cluster scope instead of extending the parameters of the method signature

tuunit · 2026-10-23T12:03:59Z

 		loadBalancer, err := cloudClient.EnsureAPIServerLoadBalancer(
 			ctx,
-			loadbalancerservice.APIServerInput(stackitCluster, seed),
+			loadbalancerservice.APIServerInput(stackitCluster, clusterScope.NetworkID(), seed),


use clusterScope as input instead of the stackitCluster and networkid

tuunit · 2026-10-23T12:04:03Z

 		return ctrl.Result{}, err
 	}
-	if err := cloudClient.DeleteBastion(ctx, bastionservice.Input(stackitCluster, nil), cloud.Bastion{
+	if err := cloudClient.DeleteBastion(ctx, bastionservice.Input(stackitCluster, clusterScope.NetworkID(), nil), cloud.Bastion{


use clusterScope as input instead of the stackitCluster and networkid

tuunit · 2026-10-23T12:06:20Z

+	networkID := machineScope.NetworkID()
+	if networkID == "" {
+		return nil, false, fmt.Errorf("%w: cluster network ID is not yet available", cloud.ErrTransient)
+	}


can this realistically even happen? i don't think the reconiliation for a machine can start if the cluster isn't reconcilled

tuunit · 2026-10-23T12:06:53Z

 		AvailabilityZone: machineScope.AvailabilityZone(),
 		SSHKeyName:       stackitMachine.Spec.SSHKeyName,
-		NetworkID:        stackitMachine.Spec.Network.ID,
+		NetworkID:        networkID,


so most likely it is sufficient to use machineScope.NetworkID() here and it shouldn't case any issues

tuunit · 2026-10-23T12:07:45Z

+	if s.StackitMachine != nil && s.StackitMachine.Spec.Network.ID != "" {
+		return s.StackitMachine.Spec.Network.ID
+	}
+	if s.StackitCluster != nil {


is this possible?

i tried the most defensive approach and existing availabilityZone() is doing this too. I am not sure tho, open to change that...

Co-authored-by: Jan Larwig <jan.larwig@digits.schwarz>

feat(api): make network.id optional and add network status for manage…

68ea711

…d networks

fabian-schmitt linked an issue Oct 15, 2026 that may be closed by this pull request

Support managed network creation in StackitCluster #9

Open

fabian-schmitt added 3 commits October 15, 2026 14:01

feat(api): make network.id optional and add network status for manage…

b5dc72e

…d networks

feat(webhook): allow optional network.id

52024ab

feat(api): make network.id optional and add network status for manage…

12dd6b8

…d networks

fabian-schmitt self-assigned this Oct 15, 2026

fabian-schmitt added 9 commits October 15, 2026 16:51

feat(api): start implementing ensure network creation function

4c7d5bd

feat(api): start implementing ensure network creation function

76cf0d4

feat(api): proceed with implementation plan and fix errors

b2ff9b7

fix: typo

af46e75

feat: implement createnetwork method

01980ab

feat: implement create, delete tests for network

4337b0e

feat: finalize implementation

3ede8b9

fix(test): fix credential error

ebcc0b8

fix: clean up

3b0a75a

fabian-schmitt requested a review from tuunit October 22, 2026 10:58

fabian-schmitt marked this pull request as ready for review October 22, 2026 10:58

fabian-schmitt requested a review from a team October 22, 2026 10:58

fabian-schmitt changed the title ~~feat(api): make network.id optional and add network status for manage…~~ feat(api): make network.id optional and implement network creation Oct 22, 2026

tuunit requested changes Oct 23, 2026

View reviewed changes

fabian-schmitt and others added 2 commits October 23, 2026 14:29

Update api/v1alpha1/stackitcluster_types.go

2e8b8bc

Co-authored-by: Jan Larwig <jan.larwig@digits.schwarz>

Update api/v1alpha1/stackitcluster_types.go

3a34aaa

Co-authored-by: Jan Larwig <jan.larwig@digits.schwarz>

Navigation Menu

Repository navigation

feat(api): make network.id optional and implement network creation - #34

feat(api): make network.id optional and implement network creation#34
fabian-schmitt wants to merge 15 commits into
mainfrom
feat/support-managed-network-creation

fabian-schmitt commented Oct 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

tuunit Oct 23, 2026

Uh oh!

tuunit Oct 23, 2026

Uh oh!

tuunit Oct 23, 2026

Uh oh!

tuunit Oct 23, 2026

Uh oh!

tuunit Oct 23, 2026

Uh oh!

tuunit Oct 23, 2026

Uh oh!

tuunit Oct 23, 2026

Uh oh!

tuunit Oct 23, 2026

Uh oh!

fabian-schmitt Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	func Input(stackitCluster *infrav1.StackitCluster, networkID string, cloudInit []byte) cloud.BastionInput {
	func Input(cluster *scope.ClusterScope, cloudInit []byte) cloud.BastionInput {

Conversation

fabian-schmitt commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Key Changes

Testing

ToDo or at least to discuss

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fabian-schmitt commented Oct 15, 2026 •

edited

Loading