Implement orchestrated firewall distance configuration.

[Gerrit91]

References metal-stack/metal-networker#97.

[Gerrit91]

Has to be tested in a real environment, but we can already review.

firewall-controller needs to implement support for this before this works.

[Gerrit91]

I think we can try this out in our test environment, review and merge this already. It does not hurt when the firewall-controller does not yet support it.

In the mini-lab during rolling update:

❯ k get fw,fwset,fwdeploy,fwmon -o wide                                                                                                                                                                   04:00:40
NAME                                                      PHASE      MACHINE ID                             LAST EVENT           DISTANCE   AGE   SPEC VERSION   ACTUAL VERSION
firewall.firewall.metal-stack.io/default-firewall-12e19   Running    e0ab02d2-27cd-5a5e-8efc-080ba80cf258   Phoned Home          0          13m   latest         
firewall.firewall.metal-stack.io/default-firewall-d8a9e   Creating   2294c949-88f6-5390-8154-fa53d93a3313   Booting New Kernel   3          65s   latest         

NAME                                                 REPLICAS   READY   PROGRESSING   UNHEALTHY   DISTANCE   AGE
firewallset.firewall.metal-stack.io/firewall-12dfb   1          1       0             0           0          13m
firewallset.firewall.metal-stack.io/firewall-d8a81   1          0       1             0           3          65s

NAME                                                  REPLICAS   READY   PROGRESSING   UNHEALTHY   AGE
firewalldeployment.firewall.metal-stack.io/firewall   1          0       1             0           19m

And for scaling:

❯ k scale fwdeploy firewall --replicas 4
firewalldeployment.firewall.metal-stack.io/firewall scaled


❯ k get fw,fwset,fwdeploy,fwmon -o wide
NAME                                                      PHASE      MACHINE ID                             LAST EVENT    DISTANCE   AGE     SPEC VERSION   ACTUAL VERSION
firewall.firewall.metal-stack.io/default-firewall-a74a9   Creating                                                        2                  latest         
firewall.firewall.metal-stack.io/default-firewall-a74be   Creating                                                        2                  latest         
firewall.firewall.metal-stack.io/default-firewall-a74cd   Creating                                                        1                  latest         
firewall.firewall.metal-stack.io/default-firewall-d8a9e   Running    2294c949-88f6-5390-8154-fa53d93a3313   Phoned Home   0          4h52m   latest         

NAME                                                 REPLICAS   READY   PROGRESSING   UNHEALTHY   DISTANCE   AGE
firewallset.firewall.metal-stack.io/firewall-d8a81   4          1       0             3           0          4h52m

NAME                                                  REPLICAS   READY   PROGRESSING   UNHEALTHY   AGE
firewalldeployment.firewall.metal-stack.io/firewall   4          1       0             3           5h11m

[majst01]

Looks good already, would it make sense to validate the #replicas to not exceed a certain maximum ?