Add SCS2 Cluster Stacks

[jschoone]

Hi @garloff and @matofeder,

as discussed this is a PR containing the new Cluster Stack scs2.
The addons are already adjusted to use the clouds.yaml instead of generated cloud.conf (makes openstack-csp-helper unnecessary) (#225), also some variables are already renamed using lower camel case.

• Rename variables to lower camel case
• Replace Helm values with ClusterClass defaults
• Start from Kubernetes 1.31
• Adjust generate script to work with scs2
• Enable Gateway API in cilium
• Document migration path
  • What happens when changing from scs to scs2 ClusterClass?
    • Rename variables (capi controller will complain anyway)
    • CSPO can be removed
    • change managed secret
    • ORC needs to be added (if not present already)
    • ...

[jschoone]

Hi @garloff, just saw the Point with the wishlist in the PB minutes. Please use the task list in the description here to collect them

[garloff]

Thanks a lot, @jschoone !

[garloff]

More points in the wishlist (in order of decreasing priority):

• Passing CNCF e2e conformance (except [sig-network] HostPort validates that there is no conflict between pods with same hostPort but different hostIP and protocol [LinuxOnly] [Conformance] which needs a waiver to avoid outlawing cilium)
• Passing the other SCS compliance checks as well (which would include a commitment to push one patch release per month per minor version of k8s)
• Default to using octavia-ovn for both loadbalancers (and making both configurable, ideally per cluster) - Supporting ovn LB #189
• Support diskful flavors (non-default) by allowing not to attach a volume for booting (Remove default for worker_root_disk in scs cluster stack #223). Note: Technically, attaching a volume to a diskful flavor does work, but it leaves the local volume unused and is wasteful, which is bad.
• Support for additionalBlockDevice (Configure additionalBlockDevice via cluster variable #231) option -- more generally try to keep alignment with UhuruTec's requirements
• Support for Ubuntu 24.04 node images (capi-images #269)
  - [ ] Possibly a FlatCar option (Add Flatcar as OS for the node images #183), low prio
• Avoid the need to bundle the helm charts from the addons using helm's --update-dependencies.

In addition, go through old wishlist

• Apply add-on again after upgrade (Apply Add-Ons again after cluster upgrade #208)
• registryMirrors (✨ Add registry_mirrors feature #197)
• restrictKubeApi (Add restrict_kubeapi flag #110)

This list is too long -- we should not insist on getting it completed to make an scs2 worthwhile.

When prioritizing, we should have the normal benefit/effort ratio.
But also think whether features can easily be added (in a backwards-compatible way) later, because that makes them easier to skip initially.

[garloff]

Pending final testing, we should merge this, no?

[jschoone]

Pending final testing, we should merge this, no?

Yes, I squashed the commits, published openstack-scs2-1-33-v1 and added it to the README

[garloff]

Perfect -- and it passed sonobuoy run --plugin-env=e2e.E2E_PROVIDER=openstack --e2e-skip="\[Disruptive\]|NoExecuteTaintManager|\[sig-network\] HostPort validates that there is no conflict between pods with same hostPort but different hostIP and protocol".

[garloff]

Works, passes tests. Let's merge.