[Feature]: airgap: disable internetService/natService

[jfbus]

Problem to Solve

The airgap cluster should have no access to the internet. Internet service and NATs are not configured.

Proposed Solution

In the OscCluster spec, we add a network.disabled attribute defined as a list of disabled services.

Adding internet to the list disables both Nat services and the Internet service.

Additional Context

For E2E tests to work, the cluster needs to be able to download various images (CNI, CCM, ...), either through a private registry on the management cluster or by preloading images on the nodes.

Environment Details

- Kubernetes version (`kubectl version`):
- OS (`/etc/os-release`):
- Kernel (`uname -a`):
- cluster-api-provider-outscale version:
- cluster-api version:
- Install tools:
- Kubernetes distribution:
- Kubernetes distribution version:

[alistarle]

Here is some hints to help you set up a private registry for accessing the required image later. You can populate the S3 of this registry by any mean (Harbor or anything else):

# Based on twuni/docker-registry.helm values structure

# Docker image configuration
image:
  repository: registry
  tag: "3.0.0"
  pullPolicy: IfNotPresent

# Service configuration
service:
  name: registry
  type: NodePort
  port: 5000
  targetPort: 5000
  nodePort: 32000

# Ingress configuration
ingress:
  enabled: false
storage: s3

s3:
  region: {{ .Values.registry.region }}
  regionEndpoint: https://oos/.{{ .Values.registry.region }}.outscale.com
  bucket: {{ .Values.registry.bucketId }}
  secure: true
  forcepathstyle: true
# Registry configuration data
configData:
  version: 0.1
  log:
    level: info
    fields:
      service: registry
  storage:
    # Configure read-only mode
    s3:
      chunksize: 5242880
      multipartcopychunksize: 33554432
      multipartcopymaxconcurrency: 100
      multipartcopythresholdsize: 33554432
      skipverify: false
    maintenance:
      readonly:
        enabled: true
    # Use S3-compatible storage (Outscale OOS)
    cache:
      blobdescriptor: inmemory
      blobdescriptorsize: 10000
  http:
    addr: :5000
    headers:
      X-Content-Type-Options: [nosniff]
      # CORS headers for web access
      Access-Control-Allow-Origin: ['*']
      Access-Control-Allow-Methods: ['HEAD', 'GET', 'OPTIONS']
      Access-Control-Allow-Headers: ['Authorization', 'Accept', 'Cache-Control']
      Access-Control-Max-Age: [1728000]
      Access-Control-Allow-Credentials: [true]
      Access-Control-Expose-Headers: ['Docker-Content-Digest']
  health:
    storagedriver:
      enabled: true
      interval: 10s
      threshold: 3

# Pod configuration
replicaCount: 2

# Resource limits
resources:
  limits:
    cpu: 1000m
    memory: 1024Mi
  requests:
    cpu: 100m
    memory: 256Mi

secrets:
  htpasswd: ""
  haSharedSecret: ""
  s3:
    secretRef: "registry-creds"

It will expose your registry on the port 32000 Using a nodePort on all cluster nodes, then you can configure containerd to pull every image from it:

# KubeadmControlPlane
spec:
  kubeadmConfigSpec:
    files:
    - content: |-
        [host."http://127.0.0.1:32000/"]
        capabilities = ["pull", "resolve"]
        plain-http = true
      owner: root:root
      path: /etc/containerd/certs.d/_default/hosts.toml
      permissions: "0644"

# KubeadmConfigTemplate
spec:
  template:
    metadata: {}
    spec:
      files:
      - content: |-
          [host."http://127.0.0.1:32000/"]
          capabilities = ["pull", "resolve"]
          plain-http = true
        owner: root:root
        path: /etc/containerd/certs.d/_default/hosts.toml
        permissions: "0644"