feat: support reserved_internal_range in ComputeSubnetwork (#7719) (#11557)

Implement reserved_internal_range in ComputeSubnetwork.spec and
ComputeSubnetwork.spec.secondaryIpRange

- Add reserved_internal_range to ComputeSubnetworkSpec and
SubnetworkSecondaryRange API definitions
- Make ip_cidr_range optional when reserved_internal_range is configured
- Update vendored TPG Beta schema, flatteners, and expanders for
reserved_internal_range
- Implement MockGCP support for CIDR range auto-allocation and patch
operations
- Add new E2E basic golden test fixture for reservedInternalRange

Fixes #7719

Author: acpana

apis/compute/v1beta1/computesubnetwork_types.go

@@ -16,6 +16,7 @@ package v1beta1
 
 import (
 	computerefs "github.com/GoogleCloudPlatform/k8s-config-connector/apis/compute/refs"
+	networkconnectivityrefs "github.com/GoogleCloudPlatform/k8s-config-connector/apis/networkconnectivity/networkconnectivityrefs"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/apis/k8s/v1alpha1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -35,7 +36,7 @@ type ComputeSubnetworkSpec struct {
 	// Provide this property when you create the subnetwork. For example,
 	// 10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and
 	// non-overlapping within a network. Only IPv4 is supported.
-	// +required
+	// Field is optional when 'reservedInternalRangeRef' is defined, otherwise required.
 	// +kcc:proto:field=google.cloud.compute.v1.Subnetwork.ip_cidr_range
 	IPCIDRRange *string `json:"ipCidrRange,omitempty"`
 
@@ -81,6 +82,10 @@ type ComputeSubnetworkSpec struct {
 	// +required
 	Region *string `json:"region"`
 
+	// Immutable. The reference to the reserved internal range.
+	// +kcc:proto:field=google.cloud.compute.v1.Subnetwork.reserved_internal_range
+	ReservedInternalRangeRef *networkconnectivityrefs.NetworkConnectivityInternalRangeRef `json:"reservedInternalRangeRef,omitempty"`
+
 	// Immutable. Optional. The name of the resource. Used for
 	// creation and acquisition. When unset, the value of `metadata.name`
 	// is used as the default.
@@ -211,13 +216,16 @@ type SubnetworkLogConfig struct {
 
 // +kcc:proto=google.cloud.compute.v1.SubnetworkSecondaryRange
 type SubnetworkSecondaryRange struct {
-	// The range of IP addresses belonging to this subnetwork secondary range. Provide this property when you create the subnetwork. Ranges must be unique and non-overlapping with all primary and secondary IP ranges within a network. Only IPv4 is supported. The range can be any range listed in the Valid ranges list.
-	// +required
+	// The range of IP addresses belonging to this subnetwork secondary range. Provide this property when you create the subnetwork. Ranges must be unique and non-overlapping with all primary and secondary IP ranges within a network. Only IPv4 is supported. Field is optional when 'reservedInternalRangeRef' is defined, otherwise required. The range can be any range listed in the Valid ranges list.
 	// +kcc:proto:field=google.cloud.compute.v1.SubnetworkSecondaryRange.ip_cidr_range
 	IPCIDRRange *string `json:"ipCidrRange,omitempty"`
 
 	// The name associated with this subnetwork secondary range, used when adding an alias IP range to a VM instance. The name must be 1-63 characters long, and comply with RFC1035. The name must be unique within the subnetwork.
 	// +required
 	// +kcc:proto:field=google.cloud.compute.v1.SubnetworkSecondaryRange.range_name
 	RangeName *string `json:"rangeName,omitempty"`
+
+	// The reference to the reserved internal range.
+	// +kcc:proto:field=google.cloud.compute.v1.SubnetworkSecondaryRange.reserved_internal_range
+	ReservedInternalRangeRef *networkconnectivityrefs.NetworkConnectivityInternalRangeRef `json:"reservedInternalRangeRef,omitempty"`
 }

apis/compute/v1beta1/zz_generated.deepcopy.go

@@ -0,0 +1,16 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +k8s:deepcopy-gen=package
+package networkconnectivityrefs

apis/networkconnectivity/networkconnectivityrefs/doc.go

@@ -0,0 +1,55 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package networkconnectivityrefs
+
+import (
+	"fmt"
+
+	"github.com/GoogleCloudPlatform/k8s-config-connector/apis/common/identity"
+	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/gcpurls"
+)
+
+var (
+	_ identity.IdentityV2 = &NetworkConnectivityInternalRangeIdentity{}
+)
+
+var NetworkConnectivityInternalRangeIdentityFormat = gcpurls.Template[NetworkConnectivityInternalRangeIdentity]("networkconnectivity.googleapis.com", "projects/{project}/locations/{location}/internalRanges/{internalRange}")
+
+type NetworkConnectivityInternalRangeIdentity struct {
+	Project       string
+	Location      string
+	InternalRange string
+}
+
+func (i *NetworkConnectivityInternalRangeIdentity) String() string {
+	return NetworkConnectivityInternalRangeIdentityFormat.ToString(*i)
+}
+
+func (i *NetworkConnectivityInternalRangeIdentity) FromExternal(ref string) error {
+	parsed, match, err := NetworkConnectivityInternalRangeIdentityFormat.Parse(ref)
+	if err != nil {
+		return fmt.Errorf("format of NetworkConnectivityInternalRange external=%q was not known (use %s): %w", ref, NetworkConnectivityInternalRangeIdentityFormat.CanonicalForm(), err)
+	}
+	if !match {
+		return fmt.Errorf("format of NetworkConnectivityInternalRange external=%q was not known (use %s)", ref, NetworkConnectivityInternalRangeIdentityFormat.CanonicalForm())
+	}
+
+	*i = *parsed
+	return nil
+}
+
+func (i *NetworkConnectivityInternalRangeIdentity) Host() string {
+	return NetworkConnectivityInternalRangeIdentityFormat.Host()
+}

apis/networkconnectivity/networkconnectivityrefs/networkconnectivityinternalrange_identity.go

@@ -12,23 +12,25 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package v1alpha1
+package networkconnectivityrefs_test
 
 import (
 	"testing"
+
+	"github.com/GoogleCloudPlatform/k8s-config-connector/apis/networkconnectivity/networkconnectivityrefs"
 )
 
-func TestInternalRangeIdentity_FromExternal(t *testing.T) {
+func TestNetworkConnectivityInternalRangeIdentity_FromExternal(t *testing.T) {
 	tests := []struct {
 		name    string
 		ref     string
 		wantErr bool
-		want    *InternalRangeIdentity
+		want    *networkconnectivityrefs.NetworkConnectivityInternalRangeIdentity
 	}{
 		{
 			name: "valid reference",
 			ref:  "projects/my-project/locations/us-central1/internalRanges/my-internal-range",
-			want: &InternalRangeIdentity{
+			want: &networkconnectivityrefs.NetworkConnectivityInternalRangeIdentity{
 				Project:       "my-project",
 				Location:      "us-central1",
 				InternalRange: "my-internal-range",
@@ -42,7 +44,7 @@ func TestInternalRangeIdentity_FromExternal(t *testing.T) {
 		{
 			name: "full url",
 			ref:  "https://networkconnectivity.googleapis.com/projects/my-project/locations/us-central1/internalRanges/my-internal-range",
-			want: &InternalRangeIdentity{
+			want: &networkconnectivityrefs.NetworkConnectivityInternalRangeIdentity{
 				Project:       "my-project",
 				Location:      "us-central1",
 				InternalRange: "my-internal-range",
@@ -52,7 +54,7 @@ func TestInternalRangeIdentity_FromExternal(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			i := &InternalRangeIdentity{}
+			i := &networkconnectivityrefs.NetworkConnectivityInternalRangeIdentity{}
 			err := i.FromExternal(tt.ref)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("FromExternal() error = %v, wantErr %v", err, tt.wantErr)

…nnectivityinternalrange_identity_test.go …nnectivityinternalrange_identity_test.goapis/networkconnectivity/v1alpha1/networkconnectivityinternalrange_identity_test.go renamed to apis/networkconnectivity/networkconnectivityrefs/networkconnectivityinternalrange_identity_test.go apis/networkconnectivity/v1alpha1/networkconnectivityinternalrange_identity_test.go renamed to apis/networkconnectivity/networkconnectivityrefs/networkconnectivityinternalrange_identity_test.go

@@ -12,82 +12,100 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package v1alpha1
+package networkconnectivityrefs
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/GoogleCloudPlatform/k8s-config-connector/apis/common/identity"
+	"github.com/GoogleCloudPlatform/k8s-config-connector/apis/kccscheme"
 	refs "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-var _ refs.Ref = &InternalRangeRef{}
+var NetworkConnectivityInternalRangeGVK = schema.GroupVersionKind{
+	Group:   "networkconnectivity.cnrm.cloud.google.com",
+	Version: "v1alpha1",
+	Kind:    "NetworkConnectivityInternalRange",
+}
+
+var (
+	_ refs.Ref         = &NetworkConnectivityInternalRangeRef{}
+	_ refs.ExternalRef = &NetworkConnectivityInternalRangeRef{}
+)
 
-// InternalRangeRef is a reference to a NetworkConnectivityInternalRange.
-type InternalRangeRef struct {
+type NetworkConnectivityInternalRangeRef struct {
 	// A reference to an externally managed NetworkConnectivityInternalRange resource.
 	// Should be in the format "projects/{{projectID}}/locations/{{location}}/internalRanges/{{internalrangeID}}".
 	External string `json:"external,omitempty"`
 
-	// The name of a NetworkConnectivityInternalRange resource.
+	// The name field of a NetworkConnectivityInternalRange resource.
 	Name string `json:"name,omitempty"`
 
-	// The namespace of a NetworkConnectivityInternalRange resource.
+	// The namespace field of a NetworkConnectivityInternalRange resource.
 	Namespace string `json:"namespace,omitempty"`
 }
 
 func init() {
-	refs.Register(&InternalRangeRef{}, &NetworkConnectivityInternalRange{})
+	kccscheme.RegisterRef(&NetworkConnectivityInternalRangeRef{}, NetworkConnectivityInternalRangeGVK)
 }
 
-func (r *InternalRangeRef) GetGVK() schema.GroupVersionKind {
+func (r *NetworkConnectivityInternalRangeRef) GetGVK() schema.GroupVersionKind {
 	return NetworkConnectivityInternalRangeGVK
 }
 
-func (r *InternalRangeRef) GetNamespacedName() types.NamespacedName {
+func (r *NetworkConnectivityInternalRangeRef) GetNamespacedName() types.NamespacedName {
 	return types.NamespacedName{
 		Name:      r.Name,
 		Namespace: r.Namespace,
 	}
 }
 
-func (r *InternalRangeRef) GetExternal() string {
+func (r *NetworkConnectivityInternalRangeRef) GetExternal() string {
 	return r.External
 }
 
-func (r *InternalRangeRef) SetExternal(ref string) {
+func (r *NetworkConnectivityInternalRangeRef) SetExternal(ref string) {
 	r.External = ref
 	r.Name = ""
 	r.Namespace = ""
 }
 
-func (r *InternalRangeRef) ValidateExternal(ref string) error {
-	id := &InternalRangeIdentity{}
+func (r *NetworkConnectivityInternalRangeRef) ValidateExternal(ref string) error {
+	id := &NetworkConnectivityInternalRangeIdentity{}
 	if err := id.FromExternal(ref); err != nil {
 		return err
 	}
 	return nil
 }
 
-func (r *InternalRangeRef) ParseExternalToIdentity() (identity.Identity, error) {
-	id := &InternalRangeIdentity{}
+func (r *NetworkConnectivityInternalRangeRef) ParseExternalToIdentity() (identity.Identity, error) {
+	id := &NetworkConnectivityInternalRangeIdentity{}
 	if err := id.FromExternal(r.External); err != nil {
 		return nil, err
 	}
 	return id, nil
 }
 
-func (r *InternalRangeRef) Normalize(ctx context.Context, reader client.Reader, defaultNamespace string) error {
+func (r *NetworkConnectivityInternalRangeRef) Normalize(ctx context.Context, reader client.Reader, defaultNamespace string) error {
 	fallback := func(u *unstructured.Unstructured) string {
-		identity, err := getIdentityFromInternalRangeSpec(ctx, reader, u)
+		resourceID, err := refs.GetResourceID(u)
+		if err != nil {
+			return ""
+		}
+		location, _, _ := unstructured.NestedString(u.Object, "spec", "location")
+		if location == "" {
+			return ""
+		}
+		projectID, err := refs.ResolveProjectID(ctx, reader, u)
 		if err != nil {
 			return ""
 		}
-		return identity.String()
+		return fmt.Sprintf("projects/%s/locations/%s/internalRanges/%s", projectID, location, resourceID)
 	}
 	return refs.NormalizeWithFallback(ctx, reader, r, defaultNamespace, fallback)
 }

…rkconnectivityinternalrange_reference.go …rkconnectivityinternalrange_reference.goapis/networkconnectivity/v1alpha1/networkconnectivityinternalrange_reference.go renamed to apis/networkconnectivity/networkconnectivityrefs/networkconnectivityinternalrange_reference.go apis/networkconnectivity/v1alpha1/networkconnectivityinternalrange_reference.go renamed to apis/networkconnectivity/networkconnectivityrefs/networkconnectivityinternalrange_reference.go

@@ -12,15 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package v1alpha1_test
+package networkconnectivityrefs_test
 
 import (
 	"testing"
 
-	"github.com/GoogleCloudPlatform/k8s-config-connector/apis/networkconnectivity/v1alpha1"
+	"github.com/GoogleCloudPlatform/k8s-config-connector/apis/networkconnectivity/networkconnectivityrefs"
 )
 
-func TestInternalRangeRef_ValidateExternal(t *testing.T) {
+func TestNetworkConnectivityInternalRangeRef_ValidateExternal(t *testing.T) {
 	tests := []struct {
 		name    string
 		ref     string
@@ -55,9 +55,9 @@ func TestInternalRangeRef_ValidateExternal(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			r := &v1alpha1.InternalRangeRef{}
+			r := &networkconnectivityrefs.NetworkConnectivityInternalRangeRef{}
 			if err := r.ValidateExternal(tt.ref); (err != nil) != tt.wantErr {
-				t.Errorf("InternalRangeRef.ValidateExternal() error = %v, wantErr %v", err, tt.wantErr)
+				t.Errorf("NetworkConnectivityInternalRangeRef.ValidateExternal() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
 	}