Use CiliumNetworkingSpec in GCPNetworkingSpec

Camila-B · Camila-B · commit 4df25802cff5 · 2026-03-26T22:26:00.000Z
This allows the configuration of Cilium when networking=gcp
diff --git a/k8s/crds/kops.k8s.io_clusters.yaml b/k8s/crds/kops.k8s.io_clusters.yaml
diff --git a/pkg/apis/kops/networking.go b/pkg/apis/kops/networking.go
@@ -114,6 +114,11 @@ func (n *NetworkingSpec) UsesKubenet() bool {
 	return false
 }
 
+// NetworkingIsGCPCilium returns true if our networking is derived from GCP with Cilium
+func (n *NetworkingSpec) NetworkingIsGCPCilium() bool {
+	return n.GCP != nil && n.GCP.Cilium != nil
+}
+
 // ClassicNetworkingSpec is the specification of classic networking mode, integrated into kubernetes.
 // Support been removed since Kubernetes 1.4.
 type ClassicNetworkingSpec struct{}
@@ -583,7 +588,8 @@ type LyftVPCNetworkingSpec struct {
 // GCPNetworkingSpec is the specification of GCP's native networking mode, using IP aliases.
 type GCPNetworkingSpec struct {
 	// Cilium enables Cilium on GCP.
-	Cilium *bool `json:"cilium,omitempty"`
+	// Cilium *bool `json:"cilium,omitempty"`
+	Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"`
 }
 
 // KindnetNetworkingSpec configures Kindnet settings.
@@ -612,11 +618,6 @@ type KindnetMasqueradeSpec struct {
 	NonMasqueradeCIDRs []string `json:"nonMasqueradeCIDRs,omitempty"`
 }
 
-
-func (n *NetworkingSpec) NetworkingIsGCPCilium() bool {
-	return n.GCP != nil && ValueOf(n.GCP.Cilium)
-}
-
 // ValueOf returns the value of a pointer or its zero value
 func ValueOf[T any](v *T) T {
 	if v == nil {
diff --git a/pkg/apis/kops/v1alpha2/networking.go b/pkg/apis/kops/v1alpha2/networking.go
@@ -703,7 +703,8 @@ type LyftVPCNetworkingSpec struct {
 // GCPNetworkingSpec is the specification of GCP's native networking mode, using IP aliases.
 type GCPNetworkingSpec struct {
 	// Cilium enables Cilium on GCP.
-	Cilium *bool `json:"cilium,omitempty"`
+	// Cilium *bool `json:"cilium,omitempty"`
+	Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"`
 }
 
 // KindnetNetworkingSpec configures Kindnet settings.
diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go
diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
diff --git a/pkg/apis/kops/v1alpha3/networking.go b/pkg/apis/kops/v1alpha3/networking.go
@@ -528,7 +528,8 @@ type HubbleSpec struct {
 // GCPNetworkingSpec is the specification of GCP's native networking mode, using IP aliases.
 type GCPNetworkingSpec struct {
 	// Cilium enables Cilium on GCP.
-	Cilium *bool `json:"cilium,omitempty"`
+	// Cilium *bool `json:"cilium,omitempty"`
+	Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"`
 }
 
 // KindnetNetworkingSpec configures Kindnet settings.
diff --git a/pkg/apis/kops/v1alpha3/zz_generated.conversion.go b/pkg/apis/kops/v1alpha3/zz_generated.conversion.go
diff --git a/pkg/apis/kops/v1alpha3/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha3/zz_generated.deepcopy.go
diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go
diff --git a/pkg/apis/nodeup/config.go b/pkg/apis/nodeup/config.go
@@ -347,8 +347,14 @@ func NewConfig(cluster *kops.Cluster, instanceGroup *kops.InstanceGroup) (*Confi
 
 	if cluster.Spec.Networking.GCP != nil {
 		config.Networking.GCP = &kops.GCPNetworkingSpec{}
-		if ValueOf(cluster.Spec.Networking.GCP.Cilium) {
+		if cluster.Spec.Networking.GCP.Cilium != nil {
 			config.Networking.GCP.Cilium = cluster.Spec.Networking.GCP.Cilium
+			if cluster.Spec.Networking.GCP.Cilium.IPAM == kops.CiliumIpamEni {
+				config.Networking.GCP.Cilium.IPAM = kops.CiliumIpamEni
+			}
+			if model.UseCiliumEtcd(cluster) {
+				config.UseCiliumEtcd = true
+			}
 		}
 	}
 
@@ -522,4 +528,4 @@ func ValueOf[T any](v *T) T {
 		return *new(T)
 	}
 	return *v
-}
+}
diff --git a/pkg/model/components/cilium.go b/pkg/model/components/cilium.go
@@ -35,6 +35,9 @@ var _ loader.ClusterOptionsBuilder = &CiliumOptionsBuilder{}
 func (b *CiliumOptionsBuilder) BuildOptions(o *kops.Cluster) error {
 	clusterSpec := &o.Spec
 	c := clusterSpec.Networking.Cilium
+	if c == nil && clusterSpec.Networking.GCP != nil {
+		c = clusterSpec.Networking.GCP.Cilium
+	}
 	if c == nil {
 		return nil
 	}
diff --git a/pkg/model/context.go b/pkg/model/context.go
@@ -420,5 +420,5 @@ func (b *KopsModelContext) NetworkingIsCilium() bool {
 }
 
 func (b *KopsModelContext) NetworkingIsGCPWithCilium() bool {
-	return b.Cluster.Spec.Networking.GCP != nil && fi.ValueOf(b.Cluster.Spec.Networking.GCP.Cilium)
+	return b.Cluster.Spec.Networking.GCP != nil && b.Cluster.Spec.Networking.GCP.Cilium != nil
 }
diff --git a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.15.yaml.template b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.15.yaml.template
@@ -1,4 +1,8 @@
-{{ with .Networking.Cilium }}
+{{ $cilium := .Networking.Cilium }}
+{{ if and .Networking.GCP .Networking.GCP.Cilium }}
+{{ $cilium = .Networking.GCP.Cilium }}
+{{ end }}
+{{ with $cilium }}
 ---
 {{ if CiliumSecret }}
 ---
diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go
@@ -390,6 +390,20 @@ func (c *ApplyClusterCmd) Run(ctx context.Context) (*ApplyResults, error) {
 		}
 	}
 
+	gcpSpec := c.Cluster.Spec.Networking.GCP
+	if gcpSpec != nil && gcpSpec.Cilium != nil && gcpSpec.Cilium.EnableEncryption && gcpSpec.Cilium.EncryptionType == kops.CiliumEncryptionTypeIPSec {
+		secret, err := secretStore.FindSecret("ciliumpassword")
+		if err != nil {
+			return nil, fmt.Errorf("could not load the ciliumpassword secret: %w", err)
+		}
+		if secret == nil {
+			fmt.Println("")
+			fmt.Println("You have cilium encryption enabled, but no ciliumpassword secret has been set.")
+			fmt.Println("See `kops create secret ciliumpassword -h`")
+			return nil, fmt.Errorf("could not find ciliumpassword secret")
+		}
+	}
+
 	project := ""
 	scwZone := ""
 
diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder/cilium.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder/cilium.go
@@ -19,6 +19,7 @@ package bootstrapchannelbuilder
 import (
 	"k8s.io/klog/v2"
 	"k8s.io/kops/channels/pkg/api"
+	"k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/upup/pkg/fi"
 )
 
@@ -47,6 +48,9 @@ func addCiliumAddon(b *BootstrapChannelBuilder, addons *AddonList) error {
 		if cilium != nil && cilium.Hubble != nil && fi.ValueOf(cilium.Hubble.Enabled) {
 			addon.NeedsPKI = true
 		}
+		if b.Cluster.Spec.Networking.NetworkingIsGCPCilium() && b.Cluster.Spec.Networking.GCP.Cilium.EnableEncryption && b.Cluster.Spec.Networking.GCP.Cilium.EncryptionType == kops.CiliumEncryptionTypeIPSec {
+			addon.NeedsPKI = true
+		}
 		addons.Add(addon)
 	}
 	return nil
diff --git a/upup/pkg/fi/cloudup/new_cluster.go b/upup/pkg/fi/cloudup/new_cluster.go
@@ -1276,9 +1276,18 @@ func setupNetworking(opt *NewClusterOptions, cluster *api.Cluster) error {
 	case "gcp", "gce":
 		cluster.Spec.Networking.GCP = &api.GCPNetworkingSpec{}
 	case "gcp-with-cilium":
+		//TODO: Move into own func
 		cluster.Spec.Networking.GCP = &api.GCPNetworkingSpec{}
-		ciliumBool := true
-		cluster.Spec.Networking.GCP.Cilium = &ciliumBool
+		cluster.Spec.Networking.GCP.Cilium = &api.CiliumNetworkingSpec{}
+		cluster.Spec.Networking.GCP.Cilium.EnableNodePort = true
+		cluster.Spec.Networking.GCP.Cilium.Hubble = &api.HubbleSpec{}
+		cluster.Spec.Networking.GCP.Cilium.Ingress = &api.CiliumIngressSpec{}
+		cluster.Spec.Networking.GCP.Cilium.GatewayAPI = &api.CiliumGatewayAPISpec{}
+		if cluster.Spec.KubeProxy == nil {
+			cluster.Spec.KubeProxy = &api.KubeProxyConfig{}
+		}
+		enabled := false
+		cluster.Spec.KubeProxy.Enabled = &enabled
 	case "kindnet":
 		cluster.Spec.Networking.Kindnet = &api.KindnetNetworkingSpec{}
 	default:
diff --git a/upup/pkg/fi/cloudup/template_functions.go b/upup/pkg/fi/cloudup/template_functions.go
@@ -315,7 +315,7 @@ func (tf *TemplateFunctions) AddTo(dest template.FuncMap, secretStore fi.SecretS
 		}
 	}
 
-	if cluster.Spec.Networking.Cilium != nil || cluster.Spec.Networking.NetworkingIsGCPCilium(){
+	if cluster.Spec.Networking.Cilium != nil || cluster.Spec.Networking.NetworkingIsGCPCilium() {
 		ciliumsecretString := ""
 		ciliumsecret, _ := secretStore.Secret("ciliumpassword")
 		if ciliumsecret != nil {
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/gcp-with-cilium/cluster.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/gcp-with-cilium/cluster.yaml
@@ -41,7 +41,10 @@ spec:
   kubernetesVersion: 1.35.2
   networking:
     gce:
-      cilium: true
+      cilium:
+        hubble: {}
+        ingress: {}
+        gatewayAPI: {}
   nonMasqueradeCIDR: 10.0.0.0/8
   podCIDR: 10.4.0.0/14
   project: test-project
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/gcp-with-cilium/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/gcp-with-cilium/manifest.yaml
@@ -100,7 +100,7 @@ spec:
     version: 9.99.0
   - id: k8s-1.16
     manifest: networking.cilium.io/k8s-1.16-v1.15.yaml
-    manifestHash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+    manifestHash: effb9c60ad6e4cb6da8587967778b01d06c29fa59f05ecd801f30cd9c8dcff38
     name: networking.cilium.io
     needsRollingUpdate: all
     selector:

Original file line number	Diff line number	Diff line change
`@@ -703,7 +703,8 @@ type LyftVPCNetworkingSpec struct {`
`703`	`703`	`// GCPNetworkingSpec is the specification of GCP's native networking mode, using IP aliases.`
`704`	`704`	`type GCPNetworkingSpec struct {`
`705`	`705`	`// Cilium enables Cilium on GCP.`
`706`		- Cilium *bool `json:"cilium,omitempty"`
	`706`	+ // Cilium *bool `json:"cilium,omitempty"`
	`707`	+ Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"`
`707`	`708`	`}`
`708`	`709`
`709`	`710`	`// KindnetNetworkingSpec configures Kindnet settings.`
Original file line number	Diff line number	Diff line change
`@@ -528,7 +528,8 @@ type HubbleSpec struct {`
`528`	`528`	`// GCPNetworkingSpec is the specification of GCP's native networking mode, using IP aliases.`
`529`	`529`	`type GCPNetworkingSpec struct {`
`530`	`530`	`// Cilium enables Cilium on GCP.`
`531`		- Cilium *bool `json:"cilium,omitempty"`
	`531`	+ // Cilium *bool `json:"cilium,omitempty"`
	`532`	+ Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"`
`532`	`533`	`}`
`533`	`534`
`534`	`535`	`// KindnetNetworkingSpec configures Kindnet settings.`
Original file line number	Diff line number	Diff line change
`@@ -347,8 +347,14 @@ func NewConfig(cluster kops.Cluster, instanceGroup kops.InstanceGroup) (*Confi`
`347`	`347`
`348`	`348`	`if cluster.Spec.Networking.GCP != nil {`
`349`	`349`	`config.Networking.GCP = &kops.GCPNetworkingSpec{}`
`350`		`- if ValueOf(cluster.Spec.Networking.GCP.Cilium) {`
	`350`	`+ if cluster.Spec.Networking.GCP.Cilium != nil {`
`351`	`351`	`config.Networking.GCP.Cilium = cluster.Spec.Networking.GCP.Cilium`
	`352`	`+ if cluster.Spec.Networking.GCP.Cilium.IPAM == kops.CiliumIpamEni {`
	`353`	`+ config.Networking.GCP.Cilium.IPAM = kops.CiliumIpamEni`
	`354`	`+ }`
	`355`	`+ if model.UseCiliumEtcd(cluster) {`
	`356`	`+ config.UseCiliumEtcd = true`
	`357`	`+ }`
`352`	`358`	`}`
`353`	`359`	`}`
`354`	`360`
`@@ -522,4 +528,4 @@ func ValueOf[T any](v *T) T {`
`522`	`528`	`return *new(T)`
`523`	`529`	`}`
`524`	`530`	`return *v`
`525`		`-}`
	`531`	`+}`