Add GKE NetworkPolicy support

.gitignore

@@ -52,6 +52,9 @@ manager_pull_policy.yaml-e
 # junit files
 junit.*.xml
 
+# asdf
+.tool-versions
+
 .DS_Store
 
 # Tilt files.

cloud/services/container/clusters/reconcile.go

@@ -268,6 +268,9 @@ func (s *Service) createCluster(ctx context.Context, log *logr.Logger) error {
 	if !s.scope.IsAutopilotCluster() {
 		cluster.NodePools = scope.ConvertToSdkNodePools(nodePools, machinePools, isRegional, cluster.Name)
 	}
+	if s.scope.GCPManagedControlPlane.Spec.NetworkPolicy != nil {
+		cluster.NetworkPolicy = convertToSdkNetworkPolicy(s.scope.GCPManagedControlPlane.Spec.NetworkPolicy)
+	}
 
 	createClusterRequest := &containerpb.CreateClusterRequest{
 		Cluster: cluster,
@@ -366,6 +369,20 @@ func convertToSdkMasterAuthorizedNetworksConfig(config *infrav1exp.MasterAuthori
 	}
 }
 
+// convertToSdkNetworkPolicy converts NetworkPolicy config to a value that is used by GCP SDK.
+func convertToSdkNetworkPolicy(networkPolicy *infrav1exp.NetworkPolicy) *containerpb.NetworkPolicy {
+	sdkNetworkPolicy := containerpb.NetworkPolicy{
+		Enabled: true,
+	}
+	switch networkPolicy.Provider {
+	case "calico":
+		sdkNetworkPolicy.Provider = containerpb.NetworkPolicy_CALICO
+	default:
+		sdkNetworkPolicy.Provider = containerpb.NetworkPolicy_PROVIDER_UNSPECIFIED
+	}
+	return &sdkNetworkPolicy
+}
+
 func (s *Service) checkDiffAndPrepareUpdate(existingCluster *containerpb.Cluster, log *logr.Logger) (bool, *containerpb.UpdateClusterRequest) {
 	log.V(4).Info("Checking diff and preparing update.")
 
@@ -390,7 +407,6 @@ func (s *Service) checkDiffAndPrepareUpdate(existingCluster *containerpb.Cluster
 			log.V(2).Info("Master version update required", "current", existingClusterMasterVersion, "desired", desiredMasterVersion)
 		}
 	}
-
 	// DesiredMasterAuthorizedNetworksConfig
 	// When desiredMasterAuthorizedNetworksConfig is nil, it means that the user wants to disable the feature.
 	desiredMasterAuthorizedNetworksConfig := convertToSdkMasterAuthorizedNetworksConfig(s.scope.GCPManagedControlPlane.Spec.MasterAuthorizedNetworksConfig)

config/crd/bases/infrastructure.cluster.x-k8s.io_gcpmanagedcontrolplanes.yaml

@@ -117,6 +117,17 @@ spec:
                       Public IP addresses.
                     type: boolean
                 type: object
+              networkPolicy:
+                description: NetworkPolicy represents configuration options for NetworkPolicy
+                  feature of the GKE cluster. This feature is disabled if this field
+                  is not specified.
+                properties:
+                  provider:
+                    description: The selected network policy provider.
+                    enum:
+                    - calico
+                    type: string
+                type: object
               project:
                 description: Project is the name of the project to deploy the cluster
                   to.

exp/api/v1beta1/gcpmanagedcontrolplane_types.go

@@ -57,6 +57,10 @@ type GCPManagedControlPlaneSpec struct {
 	// This feature is disabled if this field is not specified.
 	// +optional
 	MasterAuthorizedNetworksConfig *MasterAuthorizedNetworksConfig `json:"master_authorized_networks_config,omitempty"`
+	// NetworkPolicy represents configuration options for NetworkPolicy feature of the GKE cluster.
+	// This feature is disabled if this field is not specified.
+	// +optional
+	NetworkPolicy *NetworkPolicy `json:"networkPolicy,omitempty"`
 }
 
 // GCPManagedControlPlaneStatus defines the observed state of GCPManagedControlPlane.
@@ -142,6 +146,14 @@ type MasterAuthorizedNetworksConfigCidrBlock struct {
 	CidrBlock string `json:"cidr_block,omitempty"`
 }
 
+// NetworkPolicy represents configuration options for NetworkPolicy feature of the GKE cluster.
+type NetworkPolicy struct {
+	// The selected network policy provider.
+	// +kubebuilder:validation:Enum=calico
+	// +optional
+	Provider string `json:"provider,omitempty"`
+}
+
 // GetConditions returns the control planes conditions.
 func (r *GCPManagedControlPlane) GetConditions() clusterv1.Conditions {
 	return r.Status.Conditions

exp/api/v1beta1/gcpmanagedcontrolplane_webhook.go

@@ -130,6 +130,13 @@ func (r *GCPManagedControlPlane) ValidateUpdate(oldRaw runtime.Object) (admissio
 		)
 	}
 
+	if !cmp.Equal(r.Spec.NetworkPolicy, old.Spec.NetworkPolicy) {
+		allErrs = append(allErrs,
+			field.Invalid(field.NewPath("spec", "NetworkPolicy"),
+				r.Spec.NetworkPolicy, "field is immutable"),
+		)
+	}
+
 	if len(allErrs) == 0 {
 		return nil, nil
 	}