✨ Allow address exclusion

api/v1alpha2/inclusterippool_types.go

@@ -41,6 +41,11 @@ type InClusterIPPoolSpec struct {
 	// subnet) when IPv6.
 	// +optional
 	AllocateReservedIPAddresses bool `json:"allocateReservedIPAddresses,omitempty"`
+
+	// ExcludedAddresses is a list of IP addresses, which will be excluded from
+	// the set of assignable IP addresses.
+	// +optional
+	ExcludedAddresses []string `json:"excludedAddresses,omitempty"`
 }
 
 // InClusterIPPoolStatus defines the observed state of InClusterIPPool.

config/crd/bases/ipam.cluster.x-k8s.io_globalinclusterippools.yaml

@@ -181,6 +181,12 @@ spec:
                   IPv4. The provider will allocate the anycast address address (the
                   first address in the inferred subnet) when IPv6.
                 type: boolean
+              excludedAddresses:
+                description: ExcludedAddresses is a list of IP addresses, which will
+                  be excluded from the set of assignable IP addresses.
+                items:
+                  type: string
+                type: array
               gateway:
                 description: Gateway
                 type: string

config/crd/bases/ipam.cluster.x-k8s.io_inclusterippools.yaml

@@ -181,6 +181,12 @@ spec:
                   IPv4. The provider will allocate the anycast address address (the
                   first address in the inferred subnet) when IPv6.
                 type: boolean
+              excludedAddresses:
+                description: ExcludedAddresses is a list of IP addresses, which will
+                  be excluded from the set of assignable IP addresses.
+                items:
+                  type: string
+                type: array
               gateway:
                 description: Gateway
                 type: string

config/samples/ipam_v1alpha2_globalinclusterippool.yaml

@@ -13,3 +13,8 @@ spec:
   - 10.0.0.2-10.0.0.254
   prefix: 24
   gateway: 10.0.0.1
+  excludedAddresses:
+  - 10.0.0.3-10.0.1.6
+  - 10.0.0.10
+  - 10.0.0.192/26
+

config/samples/ipam_v1alpha2_inclusterippool.yaml

@@ -13,3 +13,7 @@ spec:
   - 10.0.0.2-10.0.0.254
   prefix: 24
   gateway: 10.0.0.1
+  excludedAddresses:
+  - 10.0.0.3-10.0.1.6
+  - 10.0.0.10
+  - 10.0.0.192/26

internal/controllers/ipaddressclaim_test.go

@@ -212,7 +212,7 @@ var _ = Describe("IPAddressClaimReconciler", func() {
 							"10.0.1.0", // reserved network addr
 							"10.0.1.1", // reserved gateway addr
 							"10.0.1.2",
-							"10.0.1.255", // rerved broadcast addr
+							"10.0.1.255", // reserved broadcast addr
 						},
 					},
 				}
@@ -284,6 +284,70 @@ var _ = Describe("IPAddressClaimReconciler", func() {
 			})
 		})
 
+		When("the referenced namespaced pool exists and has excluded ip addresses", func() {
+			const (
+				poolName = "test-pool-excluded"
+				first    = "test-excluded-first"
+				second   = "test-excluded-second"
+				third    = "test-excluded-third"
+			)
+
+			BeforeEach(func() {
+				pool := v1alpha2.InClusterIPPool{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      poolName,
+						Namespace: namespace,
+					},
+					Spec: v1alpha2.InClusterIPPoolSpec{
+						Prefix:  24,
+						Gateway: "10.1.1.1",
+						Addresses: []string{
+							"10.1.1.0/24",
+						},
+						ExcludedAddresses: []string{
+							"10.1.1.2-10.1.1.5",
+							"10.1.1.7",
+						},
+					},
+				}
+				Expect(k8sClient.Create(context.Background(), &pool)).To(Succeed())
+				Eventually(Get(&pool)).Should(Succeed())
+			})
+
+			AfterEach(func() {
+				deleteClaim(first, namespace)
+				deleteClaim(second, namespace)
+				deleteClaim(third, namespace)
+				deleteNamespacedPool(poolName, namespace)
+			})
+
+			It("should not allocate excluded ip addresses", func() {
+				claim := newClaim(first, namespace, "InClusterIPPool", poolName)
+				Expect(k8sClient.Create(context.Background(), &claim)).To(Succeed())
+
+				Eventually(findAddress(first, namespace)).
+					WithTimeout(time.Second).WithPolling(100 * time.Millisecond).Should(
+					HaveField("Spec.Address", "10.1.1.6"),
+				)
+
+				claim1 := newClaim(second, namespace, "InClusterIPPool", poolName)
+				Expect(k8sClient.Create(context.Background(), &claim1)).To(Succeed())
+
+				Eventually(findAddress(second, namespace)).
+					WithTimeout(time.Second).WithPolling(100 * time.Millisecond).Should(
+					HaveField("Spec.Address", "10.1.1.8"),
+				)
+
+				claim2 := newClaim(third, namespace, "InClusterIPPool", poolName)
+
+				Expect(k8sClient.Create(context.Background(), &claim2)).To(Succeed())
+				Eventually(findAddress(third, namespace)).
+					WithTimeout(time.Second).WithPolling(100 * time.Millisecond).Should(
+					HaveField("Spec.Address", "10.1.1.9"),
+				)
+			})
+		})
+
 		When("the referenced namespaced pool has out of order Addresses", func() {
 			const poolName = "test-pool"
 

internal/poolutil/pool.go

@@ -111,6 +111,15 @@ func PoolSpecToIPSet(poolSpec *v1alpha2.InClusterIPPoolSpec) (*netipx.IPSet, err
 	builder := &netipx.IPSetBuilder{}
 	builder.AddSet(addressesIPSet)
 
+	if len(poolSpec.ExcludedAddresses) > 0 {
+		excludedAddressesIPSet, err := AddressesToIPSet(poolSpec.ExcludedAddresses)
+		if err != nil {
+			return nil, err
+		}
+
+		builder.RemoveSet(excludedAddressesIPSet)
+	}
+
 	if !poolSpec.AllocateReservedIPAddresses {
 		subnet := netip.PrefixFrom(addressesIPSet.Ranges()[0].From(), poolSpec.Prefix) // safe because of webhook validation
 		subnetRange := netipx.RangeOfPrefix(subnet)

internal/poolutil/pool_test.go

@@ -128,6 +128,69 @@ var _ = Describe("PoolSpecToIPSet", func() {
 			Expect(ipSet.Contains(mustParse("192.168.0.1"))).To(BeFalse())
 		})
 	})
+	Context("With excluded ipv4 addresses", func() {
+		It("excludes ip addresses from the address pool", func() {
+			spec := &v1alpha2.InClusterIPPoolSpec{
+				Gateway: "192.168.0.1",
+				Prefix:  24,
+				Addresses: []string{
+					"192.168.0.0-192.168.0.10",
+				},
+				ExcludedAddresses: []string{
+					"192.168.0.5",
+					"192.168.0.6",
+					"192.168.0.7",
+				},
+			}
+			ipSet, err := PoolSpecToIPSet(spec)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(ipSet.Contains(mustParse("192.168.0.2"))).To(BeTrue())
+			Expect(ipSet.Contains(mustParse("192.168.0.3"))).To(BeTrue())
+			Expect(ipSet.Contains(mustParse("192.168.0.4"))).To(BeTrue())
+			Expect(ipSet.Contains(mustParse("192.168.0.5"))).To(BeFalse())
+			Expect(ipSet.Contains(mustParse("192.168.0.6"))).To(BeFalse())
+			Expect(ipSet.Contains(mustParse("192.168.0.7"))).To(BeFalse())
+			Expect(ipSet.Contains(mustParse("192.168.0.8"))).To(BeTrue())
+			Expect(ipSet.Contains(mustParse("192.168.0.9"))).To(BeTrue())
+			Expect(ipSet.Contains(mustParse("192.168.0.10"))).To(BeTrue())
+			Expect(ipSet.Contains(mustParse("192.168.0.11"))).To(BeFalse())
+			Expect(IPSetCount(ipSet)).To(Equal(6))
+		})
+		It("excludes ip subnet from the address pool", func() {
+			spec := &v1alpha2.InClusterIPPoolSpec{
+				Gateway: "192.168.0.1",
+				Prefix:  24,
+				Addresses: []string{
+					"192.168.0.0/24",
+				},
+				ExcludedAddresses: []string{
+					"192.168.0.128/25",
+				},
+			}
+			ipSet, err := PoolSpecToIPSet(spec)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(ipSet.ContainsRange(netipx.MustParseIPRange("192.168.0.2-192.168.0.127"))).To(BeTrue())
+			Expect(ipSet.ContainsRange(netipx.MustParseIPRange("192.168.0.128-192.168.0.255"))).To(BeFalse())
+			Expect(IPSetCount(ipSet)).To(Equal(126))
+		})
+		It("excludes ip range from the address pool", func() {
+			spec := &v1alpha2.InClusterIPPoolSpec{
+				Gateway: "192.168.0.1",
+				Prefix:  24,
+				Addresses: []string{
+					"192.168.0.0/24",
+				},
+				ExcludedAddresses: []string{
+					"192.168.0.2-192.168.0.20",
+				},
+			}
+			ipSet, err := PoolSpecToIPSet(spec)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(ipSet.ContainsRange(netipx.MustParseIPRange("192.168.0.2-192.168.0.20"))).To(BeFalse())
+			Expect(ipSet.ContainsRange(netipx.MustParseIPRange("192.168.0.21-192.168.0.254"))).To(BeTrue())
+			Expect(IPSetCount(ipSet)).To(Equal(234))
+		})
+	})
 
 	Context("with IPv6 addresses", func() {
 		It("converts a pool spec to a set", func() {

internal/webhooks/inclusterippool.go

@@ -91,11 +91,11 @@ func (webhook *InClusterIPPool) ValidateCreate(_ context.Context, obj runtime.Ob
 func (webhook *InClusterIPPool) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) error {
 	newPool, ok := newObj.(types.GenericInClusterPool)
 	if !ok {
-		return apierrors.NewBadRequest(fmt.Sprintf("expected a InClusterIPPool or an GlobalInClusterIPPool but got a %T", newObj))
+		return apierrors.NewBadRequest(fmt.Sprintf("expected an InClusterIPPool or a GlobalInClusterIPPool but got a %T", newObj))
 	}
 	oldPool, ok := oldObj.(types.GenericInClusterPool)
 	if !ok {
-		return apierrors.NewBadRequest(fmt.Sprintf("expected a InClusterIPPool or an GlobalInClusterIPPool but got a %T", oldObj))
+		return apierrors.NewBadRequest(fmt.Sprintf("expected an InClusterIPPool or a GlobalInClusterIPPool but got a %T", oldObj))
 	}
 
 	err := webhook.validate(oldPool, newPool)
@@ -135,7 +135,7 @@ func (webhook *InClusterIPPool) ValidateUpdate(ctx context.Context, oldObj, newO
 	}
 
 	if outOfRange := outOfRangeIPSet.Ranges(); len(outOfRange) > 0 {
-		return apierrors.NewBadRequest(fmt.Sprintf("pool addresses does not contain allocated addresses: %v", outOfRange))
+		return apierrors.NewBadRequest(fmt.Sprintf("pool addresses do not contain allocated addresses: %v", outOfRange))
 	}
 
 	return nil
@@ -145,7 +145,7 @@ func (webhook *InClusterIPPool) ValidateUpdate(ctx context.Context, oldObj, newO
 func (webhook *InClusterIPPool) ValidateDelete(ctx context.Context, obj runtime.Object) (reterr error) {
 	pool, ok := obj.(types.GenericInClusterPool)
 	if !ok {
-		return apierrors.NewBadRequest(fmt.Sprintf("expected a InClusterIPPool or an GlobalInClusterIPPool but got a %T", obj))
+		return apierrors.NewBadRequest(fmt.Sprintf("expected an InClusterIPPool or a GlobalInClusterIPPool but got a %T", obj))
 	}
 
 	if _, ok := pool.GetAnnotations()[SkipValidateDeleteWebhookAnnotation]; ok {
@@ -212,6 +212,26 @@ func (webhook *InClusterIPPool) validate(_, newPool types.GenericInClusterPool)
 		}
 	}
 
+	excludedHasIPv4Addr, excludedHasIPv6Addr := false, false
+	for _, address := range newPool.PoolSpec().ExcludedAddresses {
+		ipSet, err := poolutil.AddressToIPSet(address)
+		if err != nil {
+			allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "excludedAddresses"), address, "provided address is not a valid IP, range, nor CIDR"))
+			continue
+		}
+		from := ipSet.Ranges()[0].From()
+		excludedHasIPv4Addr = excludedHasIPv4Addr || from.Is4()
+		excludedHasIPv6Addr = excludedHasIPv6Addr || from.Is6()
+	}
+
+	if excludedHasIPv4Addr && excludedHasIPv6Addr {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "excludedAddresses"), newPool.PoolSpec().ExcludedAddresses, "provided addresses are of mixed IP families"))
+	}
+
+	if (hasIPv4Addr && excludedHasIPv6Addr) || (hasIPv6Addr && excludedHasIPv4Addr) {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "excludedAddresses"), newPool.PoolSpec().ExcludedAddresses, "addresses and excluded addresses are of mixed IP families"))
+	}
+
 	if len(allErrs) == 0 {
 		errs := validateAddressesAreWithinPrefix(newPool.PoolSpec())
 		if len(errs) != 0 {