Assemble a fabric from input objects, resolved per device like group_vars

apis/connectedendpoints/composition.yaml

@@ -0,0 +1,16 @@
+# Composition for ConnectedEndpoints: validate this fragment and report on its own status.
+# Uses the same function image as Fabric and Device, which dispatches on the
+# composite kind.
+apiVersion: apiextensions.crossplane.io/v1
+kind: Composition
+metadata:
+  name: connectedendpoints-avd
+spec:
+  compositeTypeRef:
+    apiVersion: avd.netclab.dev/v1alpha1
+    kind: ConnectedEndpoints
+  mode: Pipeline
+  pipeline:
+    - step: validate-input
+      functionRef:
+        name: netclab-function-avd

apis/connectedendpoints/xrd.yaml

@@ -0,0 +1,103 @@
+# CompositeResourceDefinition for what connects to the fabric.
+#
+# Carries `connected_endpoints_keys.key` lists -- `servers`, `firewalls` and the
+# rest -- plus `port_profiles` and `network_ports`. Its own kind for the same
+# reason as NetworkServices: whoever attaches servers is rarely whoever owns the
+# fabric, and RBAC is granted per kind.
+#
+# Named ConnectedEndpoints, not Endpoints, because Endpoints is a core/v1 kind
+# and `kubectl get endpoints` would become ambiguous.
+apiVersion: apiextensions.crossplane.io/v2
+kind: CompositeResourceDefinition
+metadata:
+  name: connectedendpoints.avd.netclab.dev
+spec:
+  scope: Namespaced
+  group: avd.netclab.dev
+  names:
+    kind: ConnectedEndpoints
+    plural: connectedendpoints
+    categories:
+    - crossplane
+    - netclab
+  defaultCompositionRef:
+    name: connectedendpoints-avd
+  versions:
+    - name: v1alpha1
+      served: true
+      referenceable: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                design:
+                  type: object
+                  description: >-
+                    The endpoints this input contributes. Structurally open:
+                    the top-level key names come from connected_endpoints_keys,
+                    so they are decided by the document's own content and no
+                    OpenAPI schema can describe them.
+                  x-kubernetes-preserve-unknown-fields: true
+                appliesTo:
+                  type: object
+                  description: >-
+                    Devices that see this input. Defaults to every device in the
+                    fabric.
+                  properties:
+                    all:
+                      type: boolean
+                    nodeSets:
+                      type: array
+                      description: Devices declared by the named NodeSets.
+                      items:
+                        type: string
+                    hosts:
+                      type: array
+                      description: Devices named directly.
+                      items:
+                        type: string
+                    matchHostnames:
+                      type: array
+                      description: >-
+                        Regular expressions matched against device names. Same
+                        semantics as AVD's own default_node_types, which matches
+                        hostnames this way: the pattern is anchored for you, so
+                        `dc1-leaf.*` matches the whole name. A pattern matching
+                        no device is an error, not an empty set -- a pattern is
+                        silent about both matching nothing and matching too much,
+                        and the render is pushed as a full config replacement.
+                      items:
+                        type: string
+              required:
+                - design
+            status:
+              type: object
+              properties:
+                keys:
+                  type: array
+                  description: Top-level eos_designs keys this input contributes.
+                  items:
+                    type: string
+                devices:
+                  type: array
+                  description: >-
+                    Devices this input resolved to. Reported rather than left to
+                    be inferred, because appliesTo may be a pattern and a pattern
+                    does not say what it matched.
+                  items:
+                    type: string
+                validation:
+                  type: object
+                  description: >-
+                    Result of validating this fragment. Reported here rather than
+                    on the Fabric so the team that owns this object sees its own
+                    error on its own object.
+                  properties:
+                    ok:
+                      type: boolean
+                    message:
+                      type: string
+              x-kubernetes-preserve-unknown-fields: true

apis/device/xrd.yaml

@@ -19,6 +19,9 @@ spec:
   names:
     kind: Device
     plural: devices
+    categories:
+    - crossplane
+    - netclab
   # Devices are composed by the Fabric function without an explicit composition
   # selector; pin the default so selection is deterministic.
   defaultCompositionRef:

apis/fabric/xrd.yaml

@@ -22,6 +22,9 @@ spec:
   names:
     kind: Fabric
     plural: fabrics
+    categories:
+    - crossplane
+    - netclab
   defaultCompositionRef:
     name: fabric-avd
   versions:
@@ -46,8 +49,45 @@ spec:
                   description: >-
                     Fabric-wide AVD eos_designs input document (node-type blocks,
                     default_node_types, tenants, connected endpoints, ...).
-                    Validated by pyavd; violations reported on status.
+                    Validated by pyavd; violations reported on status. A fabric
+                    may instead be assembled from input objects listed in
+                    spec.requires, in which case this carries only what is
+                    fabric-wide and the inputs carry the rest.
                   x-kubernetes-preserve-unknown-fields: true
+                requires:
+                  type: array
+                  description: >-
+                    The input objects composing this fabric. Only objects listed
+                    here take part in the render, however they are labelled --
+                    which is what makes the rendered document a function of this
+                    Fabric rather than of whatever else exists in the namespace,
+                    and it matters because the render is pushed as a full config
+                    replacement. An entry that does not resolve leaves the Fabric
+                    not ready, naming the object it could not find. List order is
+                    the merge order: a later input replaces an earlier one's keys,
+                    which is how a setting is narrowed to part of the fabric.
+                  items:
+                    type: object
+                    properties:
+                      kind:
+                        type: string
+                        enum:
+                          - NodeSet
+                          - NetworkServices
+                          - ConnectedEndpoints
+                          - Settings
+                          - Secret
+                      name:
+                        type: string
+                        minLength: 1
+                      namespace:
+                        type: string
+                        description: >-
+                          Namespace holding the object. Defaults to the Fabric's
+                          own namespace.
+                    required:
+                      - kind
+                      - name
                 push:
                   type: object
                   description: >-

apis/networkservices/composition.yaml

@@ -0,0 +1,16 @@
+# Composition for NetworkServices: validate this fragment and report on its own status.
+# Uses the same function image as Fabric and Device, which dispatches on the
+# composite kind.
+apiVersion: apiextensions.crossplane.io/v1
+kind: Composition
+metadata:
+  name: networkservices-avd
+spec:
+  compositeTypeRef:
+    apiVersion: avd.netclab.dev/v1alpha1
+    kind: NetworkServices
+  mode: Pipeline
+  pipeline:
+    - step: validate-input
+      functionRef:
+        name: netclab-function-avd

apis/networkservices/xrd.yaml

@@ -0,0 +1,104 @@
+# CompositeResourceDefinition for a fabric's network services.
+#
+# Carries the tenants -- `network_services_keys.name`, `tenants` by default --
+# with their VRFs, SVIs and L2 VLANs. Its own kind because network services are
+# owned by whoever runs the services, not by whoever owns the spines, and RBAC
+# is granted per kind.
+#
+# It normally applies to every device: AVD decides per node which services land
+# there, through `filter.tenants` and `filter.tags` on the node, so this input
+# does not have to be scoped by hand.
+apiVersion: apiextensions.crossplane.io/v2
+kind: CompositeResourceDefinition
+metadata:
+  name: networkservices.avd.netclab.dev
+spec:
+  scope: Namespaced
+  group: avd.netclab.dev
+  names:
+    kind: NetworkServices
+    plural: networkservices
+    categories:
+    - crossplane
+    - netclab
+  defaultCompositionRef:
+    name: networkservices-avd
+  versions:
+    - name: v1alpha1
+      served: true
+      referenceable: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                design:
+                  type: object
+                  description: >-
+                    The tenants this input contributes. Structurally open:
+                    the top-level key names come from network_services_keys, so
+                    they are decided by the document's own content and no OpenAPI
+                    schema can describe them.
+                  x-kubernetes-preserve-unknown-fields: true
+                appliesTo:
+                  type: object
+                  description: >-
+                    Devices that see this input. Defaults to every device in the
+                    fabric.
+                  properties:
+                    all:
+                      type: boolean
+                    nodeSets:
+                      type: array
+                      description: Devices declared by the named NodeSets.
+                      items:
+                        type: string
+                    hosts:
+                      type: array
+                      description: Devices named directly.
+                      items:
+                        type: string
+                    matchHostnames:
+                      type: array
+                      description: >-
+                        Regular expressions matched against device names. Same
+                        semantics as AVD's own default_node_types, which matches
+                        hostnames this way: the pattern is anchored for you, so
+                        `dc1-leaf.*` matches the whole name. A pattern matching
+                        no device is an error, not an empty set -- a pattern is
+                        silent about both matching nothing and matching too much,
+                        and the render is pushed as a full config replacement.
+                      items:
+                        type: string
+              required:
+                - design
+            status:
+              type: object
+              properties:
+                keys:
+                  type: array
+                  description: Top-level eos_designs keys this input contributes.
+                  items:
+                    type: string
+                devices:
+                  type: array
+                  description: >-
+                    Devices this input resolved to. Reported rather than left to
+                    be inferred, because appliesTo may be a pattern and a pattern
+                    does not say what it matched.
+                  items:
+                    type: string
+                validation:
+                  type: object
+                  description: >-
+                    Result of validating this fragment. Reported here rather than
+                    on the Fabric so the team that owns this object sees its own
+                    error on its own object.
+                  properties:
+                    ok:
+                      type: boolean
+                    message:
+                      type: string
+              x-kubernetes-preserve-unknown-fields: true

apis/nodeset/composition.yaml

@@ -0,0 +1,16 @@
+# Composition for NodeSet: validate this fragment and report on its own status.
+# Uses the same function image as Fabric and Device, which dispatches on the
+# composite kind.
+apiVersion: apiextensions.crossplane.io/v1
+kind: Composition
+metadata:
+  name: nodeset-avd
+spec:
+  compositeTypeRef:
+    apiVersion: avd.netclab.dev/v1alpha1
+    kind: NodeSet
+  mode: Pipeline
+  pipeline:
+    - step: validate-input
+      functionRef:
+        name: netclab-function-avd