Add logic to reduce full resync of firewall zonea

Chore: Formatting

api/v1beta1/networkconfiguration_types.go

@@ -29,6 +29,7 @@ type NetworkconfigurationSpec struct {
 	// Important: Run "make" to regenerate code after modifying this file
 
 	// Foo is an example field of Networkconfiguration. Edit networkconfiguration_types.go to remove/update
+	ID                        string `json:"_id,omitempty"`
 	Enabled                   bool   `json:"enabled,omitempty"`
 	FirewallZone              string `json:"firewall_zone,omitempty"`
 	GatewayType               string `json:"gateway_type,omitempty"`
@@ -39,7 +40,6 @@ type NetworkconfigurationSpec struct {
 	Ipv6SettingPreference     string `json:"ipv6_setting_preference,omitempty"`
 	Ipv6Subnet                string `json:"ipv6_subnet,omitempty"`
 	Name                      string `json:"name"`
-	NetworkID                 string `json:"network_id,omitempty"`
 	Networkgroup              string `json:"networkgroup,omitempty"`
 	Purpose                   string `json:"purpose,omitempty"`
 	SettingPreference         string `json:"setting_preference,omitempty"`

api/v1beta1/zz_generated.deepcopy.go

@@ -92,6 +92,11 @@ func (in *FirewallGroupSpec) DeepCopyInto(out *FirewallGroupSpec) {
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
+	if in.ManualPorts != nil {
+		in, out := &in.ManualPorts, &out.ManualPorts
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	if in.AutoIncludeSelector != nil {
 		in, out := &in.AutoIncludeSelector, &out.AutoIncludeSelector
 		*out = new(v1.LabelSelector)

cmd/main.go

@@ -38,9 +38,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 
 	unifiv1beta1 "github.com/vegardengen/unifi-network-operator/api/v1beta1"
+	"github.com/vegardengen/unifi-network-operator/internal/config"
 	"github.com/vegardengen/unifi-network-operator/internal/controller"
 	"github.com/vegardengen/unifi-network-operator/internal/unifi"
-	"github.com/vegardengen/unifi-network-operator/internal/config"
 	// +kubebuilder:scaffold:imports
 )
 

config/crd/bases/unifi.engen.priv.no_networkconfigurations.yaml

@@ -40,9 +40,11 @@ spec:
           spec:
             description: NetworkconfigurationSpec defines the desired state of Networkconfiguration.
             properties:
-              enabled:
+              _id:
                 description: Foo is an example field of Networkconfiguration. Edit
                   networkconfiguration_types.go to remove/update
+                type: string
+              enabled:
                 type: boolean
               firewall_zone:
                 type: string
@@ -62,8 +64,6 @@ spec:
                 type: string
               name:
                 type: string
-              network_id:
-                type: string
               networkgroup:
                 type: string
               purpose:

internal/config/config.go

@@ -42,4 +42,3 @@ func (c *ConfigLoaderType) GetConfig(ctx context.Context, name string) (*corev1.
 
 	return cm, err
 }
-

internal/controller/firewallgroup_controller.go

@@ -21,10 +21,10 @@ import (
 	"fmt"
 	"net"
 	"reflect"
+	"regexp"
 	"slices"
 	"strconv"
 	"strings"
-	"regexp"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -39,8 +39,8 @@ import (
 
 	goUnifi "github.com/vegardengen/go-unifi/unifi"
 	unifiv1beta1 "github.com/vegardengen/unifi-network-operator/api/v1beta1"
-	"github.com/vegardengen/unifi-network-operator/internal/unifi"
 	"github.com/vegardengen/unifi-network-operator/internal/config"
+	"github.com/vegardengen/unifi-network-operator/internal/unifi"
 )
 
 // FirewallGroupReconciler reconciles a FirewallGroup object
@@ -118,16 +118,16 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
 		port_type := "tcp"
 		port := portEntry
 		if match, _ := regexp.MatchString("(?:tcp|udp)\\/?)\\d+", string(portEntry)); match {
-		  fields := strings.Split("/",portEntry)
+			fields := strings.Split("/", portEntry)
 			port_type = fields[0]
 			port = fields[1]
 		}
-		if(port_type == "tcp") {
+		if port_type == "tcp" {
 			if !slices.Contains(tcpports, port) {
 				tcpports = append(tcpports, port)
 			}
 		}
-		if(port_type == "udp") {
+		if port_type == "udp" {
 			if !slices.Contains(udpports, port) {
 				tcpports = append(udpports, port)
 			}
@@ -162,12 +162,12 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
 				for _, portSpec := range service.Spec.Ports {
 					log.Info(fmt.Sprintf("portSpec: %+v", portSpec))
 					log.Info(fmt.Sprintf("Port: %s %d", strconv.Itoa(int(portSpec.Port)), portSpec.Port))
-					if(portSpec.Protocol == "TCP") {
+					if portSpec.Protocol == "TCP" {
 						if !slices.Contains(tcpports, strconv.Itoa(int(portSpec.Port))) {
 							tcpports = append(tcpports, strconv.Itoa(int(portSpec.Port)))
 						}
 					}
-					if(portSpec.Protocol == "UDP") {
+					if portSpec.Protocol == "UDP" {
 						if !slices.Contains(udpports, strconv.Itoa(int(portSpec.Port))) {
 							udpports = append(udpports, strconv.Itoa(int(portSpec.Port)))
 						}

internal/controller/firewallrule_controller.go

@@ -25,8 +25,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	unifiv1beta1 "github.com/vegardengen/unifi-network-operator/api/v1beta1"
-	"github.com/vegardengen/unifi-network-operator/internal/unifi"
 	"github.com/vegardengen/unifi-network-operator/internal/config"
+	"github.com/vegardengen/unifi-network-operator/internal/unifi"
 )
 
 // FirewallRuleReconciler reconciles a FirewallRule object
@@ -64,6 +64,11 @@ func (r *FirewallRuleReconciler) Reconcile(ctx context.Context, req ctrl.Request
 	defaultNs := cfg.Data["defaultNamespace"]
 	log.Info(defaultNs)
 
+	err = r.UnifiClient.Reauthenticate()
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+
 	return ctrl.Result{}, nil
 }
 

internal/controller/firewallzone_controller.go

@@ -19,8 +19,8 @@ package controller
 import (
 	"context"
 	"fmt"
-	"strings"
 	"regexp"
+	"strings"
 	"time"
 
 	"k8s.io/apimachinery/pkg/runtime"
@@ -29,8 +29,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	unifiv1beta1 "github.com/vegardengen/unifi-network-operator/api/v1beta1"
-	"github.com/vegardengen/unifi-network-operator/internal/unifi"
 	"github.com/vegardengen/unifi-network-operator/internal/config"
+	"github.com/vegardengen/unifi-network-operator/internal/unifi"
 )
 
 // FirewallZoneReconciler reconciles a FirewallZone object
@@ -62,7 +62,6 @@ func toKubeName(input string) string {
 	return name
 }
 
-
 // +kubebuilder:rbac:groups=unifi.engen.priv.no,resources=firewallzones,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=unifi.engen.priv.no,resources=firewallzones/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=unifi.engen.priv.no,resources=firewallzones/finalizers,verbs=update
@@ -87,6 +86,66 @@ func (r *FirewallZoneReconciler) Reconcile(ctx context.Context, req ctrl.Request
 
 	defaultNs := cfg.Data["defaultNamespace"]
 
+	err = r.UnifiClient.Reauthenticate()
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+
+	fullSyncZone := "gateway"
+	if cfg.Data["fullSyncZone"] != "" {
+		fullSyncZone = cfg.Data["fullSyncZone"]
+	}
+
+	fullSync := false
+	var zoneObj unifiv1beta1.FirewallZone
+	if err := r.Get(ctx, req.NamespacedName, &zoneObj); err != nil {
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+
+	log.Info(fmt.Sprintf("fullSyncZone: %s Zone: %s", fullSyncZone, zoneObj.Name))
+	if zoneObj.Name == fullSyncZone {
+		fullSync = true
+		log.Info("Going into fullsync mode")
+	}
+
+	err = r.UnifiClient.Reauthenticate()
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+
+	if !fullSync {
+		firewallzones, err := r.UnifiClient.Client.ListFirewallZones(context.Background(), r.UnifiClient.SiteID)
+		if err != nil {
+			log.Error(err, "Could not list firewall zones")
+			return ctrl.Result{}, err
+		}
+		found := false
+		for _, unifizone := range firewallzones {
+			if unifizone.Name == zoneObj.Spec.Name {
+				found = true
+				zoneSpec := unifiv1beta1.FirewallZoneSpec{
+					Name:        unifizone.Name,
+					ID:          unifizone.ID,
+					DefaultZone: unifizone.DefaultZone,
+					NetworkIDs:  unifizone.NetworkIDs,
+				}
+				zoneObj.Spec = zoneSpec
+				err := r.Update(ctx, &zoneObj)
+				if err != nil {
+					return ctrl.Result{}, err
+				}
+			}
+		}
+		if !found {
+			err := r.Delete(ctx, &zoneObj)
+			if err != nil {
+				return ctrl.Result{}, err
+			}
+		}
+		return ctrl.Result{}, nil
+	}
+	log.Info("Starting fullsync mode")
+
 	var fwzCRDs unifiv1beta1.FirewallZoneList
 	_ = r.List(ctx, &fwzCRDs, client.InNamespace(defaultNs))
 
@@ -118,17 +177,17 @@ func (r *FirewallZoneReconciler) Reconcile(ctx context.Context, req ctrl.Request
 	for _, unifizone := range firewall_zones {
 		log.Info(fmt.Sprintf("%+v\n", unifizone))
 		if _, found := firewallZoneNamesCRDs[unifizone.Name]; !found {
-			zoneCRD := &unifiv1beta1.FirewallZone {
+			zoneCRD := &unifiv1beta1.FirewallZone{
-				ObjectMeta : ctrl.ObjectMeta {
+				ObjectMeta: ctrl.ObjectMeta{
 					Name:      toKubeName(unifizone.Name),
 					Namespace: defaultNs,
 				},
-				Spec: unifiv1beta1.FirewallZoneSpec {
+				Spec: unifiv1beta1.FirewallZoneSpec{
-					Name : unifizone.Name,
+					Name:        unifizone.Name,
-					ID : unifizone.ID,
+					ID:          unifizone.ID,
 					DefaultZone: unifizone.DefaultZone,
-					ZoneKey : unifizone.ZoneKey,
+					ZoneKey:     unifizone.ZoneKey,
-					NetworkIDs : unifizone.NetworkIDs,
+					NetworkIDs:  unifizone.NetworkIDs,
 				},
 			}
 			err := r.Create(ctx, zoneCRD)
@@ -138,12 +197,12 @@ func (r *FirewallZoneReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		} else {
 			for _, zoneCRD := range fwzCRDs.Items {
 				if zoneCRD.Spec.Name == unifizone.Name {
-				    zoneCRD.Spec = unifiv1beta1.FirewallZoneSpec {
+					zoneCRD.Spec = unifiv1beta1.FirewallZoneSpec{
-                                        Name : unifizone.Name,
+						Name:        unifizone.Name,
-                                        ID : unifizone.ID,
+						ID:          unifizone.ID,
 						DefaultZone: unifizone.DefaultZone,
-                                        ZoneKey : unifizone.ZoneKey,
+						ZoneKey:     unifizone.ZoneKey,
-                                        NetworkIDs : unifizone.NetworkIDs,
+						NetworkIDs:  unifizone.NetworkIDs,
 					}
 					err := r.Update(ctx, &zoneCRD)
 					if err != nil {

internal/controller/networkconfiguration_controller.go

@@ -19,6 +19,7 @@ package controller
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -26,8 +27,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	unifiv1 "github.com/vegardengen/unifi-network-operator/api/v1beta1"
-	"github.com/vegardengen/unifi-network-operator/internal/unifi"
 	"github.com/vegardengen/unifi-network-operator/internal/config"
+	"github.com/vegardengen/unifi-network-operator/internal/unifi"
 )
 
 // NetworkconfigurationReconciler reconciles a Networkconfiguration object
@@ -62,53 +63,154 @@ func (r *NetworkconfigurationReconciler) Reconcile(ctx context.Context, req ctrl
 	defaultNs := cfg.Data["defaultNamespace"]
 	log.Info(defaultNs)
 
-	var networkCRDs unifiv1.NetworkconfigurationList
+	fullSyncNetwork := "core"
-	if err := r.List(ctx, &networkCRDs); err != nil {
+	if cfg.Data["fullSyncNetwork"] != "" {
+		fullSyncNetwork = cfg.Data["fullSyncNetwork"]
+	}
+
+	fullSync := false
+	var networkObj unifiv1.Networkconfiguration
+	if err := r.Get(ctx, req.NamespacedName, &networkObj); err != nil {
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+
+	log.Info(fmt.Sprintf("fullSyncNetwork: %s Network: %s", fullSyncNetwork, networkObj.Name))
+	if networkObj.Name == fullSyncNetwork {
+		fullSync = true
+		log.Info("Going into fullsync mode")
+	}
+
+	err = r.UnifiClient.Reauthenticate()
+	if err != nil {
 		return ctrl.Result{}, err
 	}
-	k8sNetworks := make(map[string]*unifiv1.Networkconfiguration)
+
-	for i := range networkCRDs.Items {
+	if !fullSync {
-		log.Info(fmt.Sprintf("Inserting network %s\n", networkCRDs.Items[i].Spec.NetworkID))
+		networks, err := r.UnifiClient.Client.ListNetwork(context.Background(), r.UnifiClient.SiteID)
-		k8sNetworks[networkCRDs.Items[i].Spec.NetworkID] = &networkCRDs.Items[i]
+		if err != nil {
+			log.Error(err, "Could not list netwrorks")
+			return ctrl.Result{}, err
 		}
+		found := false
+		for _, unifinetwork := range networks {
+			if unifinetwork.Name == networkObj.Spec.Name {
+				found = true
+				networkSpec := unifiv1.NetworkconfigurationSpec{
+					Name:                      unifinetwork.Name,
+					ID:                        unifinetwork.ID,
+					IPSubnet:                  unifinetwork.IPSubnet,
+					Ipv6InterfaceType:         unifinetwork.IPV6InterfaceType,
+					Ipv6PdAutoPrefixidEnabled: unifinetwork.IPV6PDAutoPrefixidEnabled,
+					Ipv6RaEnabled:             unifinetwork.IPV6RaEnabled,
+					Ipv6SettingPreference:     unifinetwork.IPV6SettingPreference,
+					Ipv6Subnet:                unifinetwork.IPV6Subnet,
+					Purpose:                   unifinetwork.Purpose,
+					Networkgroup:              unifinetwork.NetworkGroup,
+					SettingPreference:         unifinetwork.SettingPreference,
+					Vlan:                      int64(unifinetwork.VLAN),
+					VlanEnabled:               unifinetwork.VLANEnabled,
+				}
+				networkObj.Spec = networkSpec
+				err := r.Update(ctx, &networkObj)
+				if err != nil {
+					return ctrl.Result{}, err
+				}
+			}
+		}
+		if !found {
+			err := r.Delete(ctx, &networkObj)
+			if err != nil {
+				return ctrl.Result{}, err
+			}
+		}
+		return ctrl.Result{}, nil
+	}
+	log.Info("Starting fullsync mode")
+	var networkCRDs unifiv1.NetworkconfigurationList
+	_ = r.List(ctx, &networkCRDs, client.InNamespace(defaultNs))
 
 	networks, err := r.UnifiClient.Client.ListNetwork(context.Background(), r.UnifiClient.SiteID)
 	if err != nil {
-		log.Error(err, "Failed to list Unifi Networks")
+		log.Error(err, "Could not list netwrorks")
-		return ctrl.Result{}, err
+		return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
+	}
+	log.Info(fmt.Sprintf("Number of resources: %d Number of networks in Unifi: %d", len(networkCRDs.Items), len(networks)))
+
+	var firewallZoneCRDs unifiv1.FirewallZoneList
+	err = r.List(ctx, &firewallZoneCRDs, client.InNamespace(defaultNs))
+	if err != nil {
+		log.Error(err, "Could not list firewall zones")
+		return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
 	}
 
-	seenNetworks := map[string]bool{}
+	networkNamesUnifi := make(map[string]struct{})
+	for _, unifinetwork := range networks {
+		networkNamesUnifi[unifinetwork.Name] = struct{}{}
+	}
 
-	for _, network := range networks {
+	// Step 2: Collect zones in fwzCRDs that are NOT in firewall_zones
-		networkID := network.ID
+	for _, network := range networkCRDs.Items {
-		seenNetworks[networkID] = true
+		if _, found := networkNamesUnifi[network.Spec.Name]; !found {
-		log.Info(fmt.Sprintf("Searching for  %s\n", networkID))
+			err := r.Delete(ctx, &network)
-
+			if err != nil {
-		if existing, found := k8sNetworks[networkID]; found {
+				return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
-			log.Info(fmt.Sprintf("Found network match: %s/%s", existing.Spec.NetworkID, networkID))
+			}
+		}
+	}
+	networkNamesCRDs := make(map[string]struct{})
+	for _, networkCRD := range networkCRDs.Items {
+		networkNamesCRDs[networkCRD.Spec.Name] = struct{}{}
+	}
+	for _, unifinetwork := range networks {
+		if unifinetwork.Purpose == "corporate" {
+			networkSpec := unifiv1.NetworkconfigurationSpec{
+				Name:                      unifinetwork.Name,
+				ID:                        unifinetwork.ID,
+				IPSubnet:                  unifinetwork.IPSubnet,
+				Ipv6InterfaceType:         unifinetwork.IPV6InterfaceType,
+				Ipv6PdAutoPrefixidEnabled: unifinetwork.IPV6PDAutoPrefixidEnabled,
+				Ipv6RaEnabled:             unifinetwork.IPV6RaEnabled,
+				Ipv6SettingPreference:     unifinetwork.IPV6SettingPreference,
+				Ipv6Subnet:                unifinetwork.IPV6Subnet,
+				Purpose:                   unifinetwork.Purpose,
+				Networkgroup:              unifinetwork.NetworkGroup,
+				SettingPreference:         unifinetwork.SettingPreference,
+				Vlan:                      int64(unifinetwork.VLAN),
+				VlanEnabled:               unifinetwork.VLANEnabled,
+			}
+			if _, found := networkNamesCRDs[unifinetwork.Name]; !found {
+				firewallZoneNamesCRDs := make(map[string]struct{})
+				firewallZoneIdsCRDs := make(map[string]struct{})
+				for _, firewallZoneCRD := range firewallZoneCRDs.Items {
+					firewallZoneNamesCRDs[firewallZoneCRD.Spec.Name] = struct{}{}
+					firewallZoneIdsCRDs[firewallZoneCRD.Spec.ID] = struct{}{}
+				}
+				networkCRD := &unifiv1.Networkconfiguration{
+					ObjectMeta: ctrl.ObjectMeta{
+						Name:      toKubeName(unifinetwork.Name),
+						Namespace: defaultNs,
+					},
+					Spec: networkSpec,
+				}
+				err = r.Create(ctx, networkCRD)
+				if err != nil {
+					return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
+				}
 			} else {
-			if network.Purpose == "corporate" {
+				for _, networkCRD := range networkCRDs.Items {
-				log.Info(fmt.Sprintf("New network: %s with ID %s", network.Name, network.ID))
+					if networkCRD.Spec.Name == unifinetwork.Name {
-				var networkObject unifiv1.Networkconfiguration
+						networkCRD.Spec = networkSpec
-				networkObject.Name = network.Name
+					}
-				networkObject.Spec.Name = network.Name
+					err := r.Update(ctx, &networkCRD)
-				networkObject.Spec.NetworkID = network.ID
+					if err != nil {
-				networkObject.Spec.IPSubnet = network.IPSubnet
+						return ctrl.Result{RequeueAfter: 10 * time.Minute}, err
-				networkObject.Spec.Ipv6InterfaceType = network.IPV6InterfaceType
+					}
-				networkObject.Spec.Ipv6PdAutoPrefixidEnabled = network.IPV6PDAutoPrefixidEnabled
+				}
-				networkObject.Spec.Ipv6RaEnabled = network.IPV6RaEnabled
-				networkObject.Spec.Ipv6SettingPreference = network.IPV6SettingPreference
-				networkObject.Spec.Ipv6Subnet = network.IPV6Subnet
-				networkObject.Spec.Purpose = network.Purpose
-				networkObject.Spec.Networkgroup = network.NetworkGroup
-				networkObject.Spec.SettingPreference = network.SettingPreference
-				networkObject.Spec.VlanEnabled = network.VLANEnabled
 			}
 		}
 	}
 
-	return ctrl.Result{}, nil
+	return ctrl.Result{RequeueAfter: 10 * time.Minute}, nil
 }
 
 // SetupWithManager sets up the controller with the Manager.

internal/unifi_network_operator_utils/unifi_network_operator_utils.go

@@ -0,0 +1,33 @@
+/* https://github.com/clbx/kube-port-forward-controller */
+
+package unifi_network_operator_utils
+
+import (
+	"regexp"
+	"strings"
+)
+
+func isIPv6(ip string) bool {
+	return strings.Contains(ip, ":")
+}
+
+func toKubeName(input string) string {
+	// Lowercase the input
+	name := strings.ToLower(input)
+
+	// Replace any non-alphanumeric characters with dashes
+	re := regexp.MustCompile(`[^a-z0-9\-\.]+`)
+	name = re.ReplaceAllString(name, "-")
+
+	// Trim leading and trailing non-alphanumerics
+	name = strings.Trim(name, "-.")
+
+	// Ensure it's not empty and doesn't exceed 253 characters
+	if len(name) == 0 {
+		name = "default"
+	} else if len(name) > 253 {
+		name = name[:253]
+	}
+
+	return name
+}