Add support for new SGR protocols in PowerVS

The latest vpc-go-sdk introduces two new security group rule protocol
types: 'any' and 'individual'. This commit adds full compatibility for
these new protocols in the PowerVS implementation.

Author: Pacho20

api/powervs/v1beta2/types.go

@@ -285,6 +285,9 @@ var (
 )
 
 const (
+	// VPCSecurityGroupRuleProtocolAnyType is a string representation of the 'SecurityGroupRuleProtocolAny' type.
+	VPCSecurityGroupRuleProtocolAnyType = "*vpcv1.SecurityGroupRuleProtocolAny"
+
 	// VPCSecurityGroupRuleProtocolIcmptcpudpType is a string representation of the 'SecurityGroupRuleProtocolIcmptcpudp' type.
 	VPCSecurityGroupRuleProtocolIcmptcpudpType = "*vpcv1.SecurityGroupRuleProtocolIcmptcpudp"
 
@@ -293,6 +296,9 @@ const (
 
 	// VPCSecurityGroupRuleProtocolTcpudpType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolTcpudp' type.
 	VPCSecurityGroupRuleProtocolTcpudpType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudp"
+
+	// VPCSecurityGroupRuleProtocolIndividualType is a string representation of the 'SecurityGroupRuleProtocolIndividual' type.
+	VPCSecurityGroupRuleProtocolIndividualType = "*vpcv1.SecurityGroupRuleProtocolIndividual"
 )
 
 // VPCSecurityGroupRuleAction represents the actions for a Security Group Rule.
@@ -318,10 +324,12 @@ const (
 )
 
 // VPCSecurityGroupRuleProtocol represents the protocols for a Security Group Rule.
-// +kubebuilder:validation:Enum=icmp_tcp_udp;icmp;tcp;udp
+// +kubebuilder:validation:Pattern=`^(any|icmp_tcp_udp|icmp|tcp|udp|ah|esp|gre|ip_in_ip|l2tp|rsvp|sctp|vrrp|number_(?:0|2|3|5|[7-9]|1[0-6]|1[8-9]|[2-3][0-9]|4[0-5]|4[89]|5[2-9]|[6-9][0-9]|10[0-9]|11[0-1]|11[3-4]|11[6-9]|12[0-9]|13[0-1]|13[3-9]|1[4-9][0-9]|2[0-4][0-9]|25[0-5]))$`
 type VPCSecurityGroupRuleProtocol string
 
 const (
+	// VPCSecurityGroupRuleProtocolAny defines the Rule is for any network protocols.
+	VPCSecurityGroupRuleProtocolAny VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolAnyConst
 	// VPCSecurityGroupRuleProtocolIcmpTCPUDP defines the Rule is for ICMP, TCP and UDP protocols.
 	VPCSecurityGroupRuleProtocolIcmpTCPUDP VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolIcmpTCPUDPConst
 	// VPCSecurityGroupRuleProtocolIcmp defiens the Rule is for ICMP network protocol.
@@ -447,6 +455,7 @@ type VPCSecurityGroupRuleRemote struct {
 // VPCSecurityGroupRulePrototype defines a VPC Security Group Rule's traffic specifics for a series of remotes (destinations or sources).
 // +kubebuilder:validation:XValidation:rule="self.protocol != 'icmp' ? (!has(self.icmpCode) && !has(self.icmpType)) : true",message="icmpCode and icmpType are only supported for VPCSecurityGroupRuleProtocolIcmp protocol"
 // +kubebuilder:validation:XValidation:rule="self.protocol == 'icmp' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolIcmp protocol"
+// +kubebuilder:validation:XValidation:rule="(self.protocol != 'tcp' && self.protocol != 'udp') ? !has(self.portRange) : true",message="portRange is not valid for protocol"
 // +kubebuilder:validation:XValidation:rule="self.protocol == 'icmp_tcp_udp' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolIcmpTCPUDP protocol"
 type VPCSecurityGroupRulePrototype struct {
 	// icmpCode is the ICMP code for the Rule.

cloud/scope/powervs/powervs_cluster.go

@@ -1462,6 +1462,9 @@ func (s *ClusterScope) createVPCSecurityGroupRule(ctx context.Context, securityG
 	}
 
 	switch reflect.TypeOf(ruleIntf).String() {
+	case infrav1.VPCSecurityGroupRuleProtocolAnyType:
+		rule := ruleIntf.(*vpcv1.SecurityGroupRuleProtocolAny)
+		ruleID = rule.ID
 	case infrav1.VPCSecurityGroupRuleProtocolIcmptcpudpType:
 		rule := ruleIntf.(*vpcv1.SecurityGroupRuleProtocolIcmptcpudp)
 		ruleID = rule.ID
@@ -1471,6 +1474,9 @@ func (s *ClusterScope) createVPCSecurityGroupRule(ctx context.Context, securityG
 	case infrav1.VPCSecurityGroupRuleProtocolIcmpType:
 		rule := ruleIntf.(*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolIcmp)
 		ruleID = rule.ID
+	case infrav1.VPCSecurityGroupRuleProtocolIndividualType:
+		rule := ruleIntf.(*vpcv1.SecurityGroupRuleProtocolIndividual)
+		ruleID = rule.ID
 	}
 	log.Info("Created VPC security group rule", "ruleID", *ruleID)
 	return ruleID, nil
@@ -1600,7 +1606,7 @@ func (s *ClusterScope) validateVPCSecurityGroupRuleRemote(originalSGRemote *vpcv
 }
 
 // validateSecurityGroupRule compares a specific security group's rule with the spec and existing security group's rule.
-func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vpcv1.SecurityGroupRuleIntf, direction infrav1.VPCSecurityGroupRuleDirection, rule *infrav1.VPCSecurityGroupRulePrototype, remote infrav1.VPCSecurityGroupRuleRemote) (ruleID *string, match bool, err error) {
+func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vpcv1.SecurityGroupRuleIntf, direction infrav1.VPCSecurityGroupRuleDirection, rule *infrav1.VPCSecurityGroupRulePrototype, remote infrav1.VPCSecurityGroupRuleRemote) (ruleID *string, match bool, err error) { //nolint: gocyclo
 	updateError := func(e error) {
 		err = fmt.Errorf("failed to validate VPC security group rule's remote: %w", e)
 	}
@@ -1609,6 +1615,18 @@ func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vp
 
 	for _, ogRuleIntf := range originalSecurityGroupRules {
 		switch reflect.TypeOf(ogRuleIntf).String() {
+		case infrav1.VPCSecurityGroupRuleProtocolAnyType:
+			ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleProtocolAny)
+			ruleID = ogRule.ID
+
+			if *ogRule.Direction == string(direction) && *ogRule.Protocol == protocol {
+				ogRemote := ogRule.Remote.(*vpcv1.SecurityGroupRuleRemote)
+				match, err = s.validateVPCSecurityGroupRuleRemote(ogRemote, remote)
+				if err != nil {
+					updateError(err)
+					return nil, false, err
+				}
+			}
 		case infrav1.VPCSecurityGroupRuleProtocolIcmptcpudpType:
 			ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleProtocolIcmptcpudp)
 			ruleID = ogRule.ID
@@ -1649,6 +1667,18 @@ func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vp
 					return nil, false, err
 				}
 			}
+		case infrav1.VPCSecurityGroupRuleProtocolIndividualType:
+			ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleProtocolIndividual)
+			ruleID = ogRule.ID
+
+			if *ogRule.Direction == string(direction) && *ogRule.Protocol == protocol {
+				ogRemote := ogRule.Remote.(*vpcv1.SecurityGroupRuleRemote)
+				match, err = s.validateVPCSecurityGroupRuleRemote(ogRemote, remote)
+				if err != nil {
+					updateError(err)
+					return nil, false, err
+				}
+			}
 		}
 		if match {
 			return ruleID, match, nil