[PATCH pve-network v2 17/27] sdn: microseg: add tag matcher

[Hannes Laimer <h.laimer@proxmox.com>]

A second NIC-to-group assignment matcher next to the guest matcher: a
'tagassignment' type binding every guest matching the given tags, with
tags and tag_match properties gated to it, and the guest inventory
extended to report each guest's tags.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/API2/Network/SDN/Microseg.pm |  2 +-
 src/PVE/Network/SDN/Microseg.pm      | 42 ++++++++++++++++++++++------
 2 files changed, 35 insertions(+), 9 deletions(-)

diff --git a/src/PVE/API2/Network/SDN/Microseg.pm b/src/PVE/API2/Network/SDN/Microseg.pm
index c88b5f1..fc1e4ac 100644
--- a/src/PVE/API2/Network/SDN/Microseg.pm
+++ b/src/PVE/API2/Network/SDN/Microseg.pm
@@ -97,7 +97,7 @@ __PACKAGE__->register_method({
                         id => { type => 'string', description => 'Object identifier.' },
                         type => {
                             type => 'string',
-                            enum => ['group', 'rule', 'guestassignment'],
+                            enum => ['group', 'rule', 'guestassignment', 'tagassignment'],
                         },
                         state => get_standard_option('pve-sdn-config-state'),
                         pending => {
diff --git a/src/PVE/Network/SDN/Microseg.pm b/src/PVE/Network/SDN/Microseg.pm
index 4f135c6..f000ce6 100644
--- a/src/PVE/Network/SDN/Microseg.pm
+++ b/src/PVE/Network/SDN/Microseg.pm
@@ -39,7 +39,7 @@ cfs_register_file('sdn/microseg.cfg', \&parse_microseg_config, \&write_microseg_
 # The stored section types of the assignment family, one per matcher kind. The API presents them
 # under a single 'assignment' endpoint that discriminates on the 'type' property (storage splits
 # them so each section carries only its matcher's fields). Add a new matcher's stored type here.
-our $ASSIGNMENT_TYPES = ['guestassignment'];
+our $ASSIGNMENT_TYPES = ['guestassignment', 'tagassignment'];
 
 sub parse_microseg_config {
     my ($filename, $raw) = @_;
@@ -184,7 +184,8 @@ sub assignment_properties {
         $properties->{type} = {
             type => 'string',
             enum => $ASSIGNMENT_TYPES,
-            description => "The matcher kind: 'guestassignment' binds a specific guest.",
+            description => "The matcher kind: 'guestassignment' binds a specific guest,"
+                . " 'tagassignment' binds every guest carrying the matched tags.",
         };
         $properties->{vmid} = get_standard_option(
             'pve-vmid',
@@ -195,6 +196,27 @@ sub assignment_properties {
                 description => "Guest matcher: the guest whose NIC(s) to bind.",
             },
         );
+        $properties->{tags} = {
+            type => 'array',
+            items => {
+                type => 'string',
+                format => 'pve-tag',
+            },
+            optional => 1,
+            'type-property' => 'type',
+            'instance-types' => ['tagassignment'],
+            description => "Tag matcher: the guest tags to match.",
+        };
+        $properties->{tag_match} = {
+            type => 'string',
+            enum => ['any', 'all', 'exact'],
+            optional => 1,
+            default => 'any',
+            'type-property' => 'type',
+            'instance-types' => ['tagassignment'],
+            description => "How tags match: any (the guest shares a listed tag), all"
+                . " (the guest carries every listed tag), or exact (its tags equal the listed set).",
+        };
         $properties->{iface} = {
             type => 'integer',
             minimum => 0,
@@ -207,24 +229,28 @@ sub assignment_properties {
     return $properties;
 }
 
-# The guest inventory assignments are expanded against at render time: every guest and the netN
-# indices it currently has. Pulled cluster-wide from the pmxcfs in-memory index in a single call
-# (>100x faster than parsing each config). All guests are included, since a guest matcher with no
-# iface needs the guest's NIC list too. Returns an arrayref of { vmid, nics => [...] } for the Rust
-# render / realized expansion.
+# The guest inventory assignments are expanded against at render time: every guest, with its tags
+# and the netN indices it currently has. Pulled cluster-wide from the pmxcfs in-memory index in a
+# single call (faster than parsing each config). All guests are included (not just tagged
+# ones), since a guest matcher with no iface needs the guest's NIC list too. Returns an arrayref of
+# { vmid, tags => [...], nics => [...] } for the Rust render / realized expansion.
 sub guest_inventory {
-    my $props = [map { "net$_" } 0 .. 31];
+    my $props = ['tags', map { "net$_" } 0 .. 31];
     my $by_vmid = PVE::Cluster::get_guest_config_properties($props);
 
     my $inventory = [];
     for my $vmid (sort { $a <=> $b } keys %$by_vmid) {
         my $guest = $by_vmid->{$vmid};
 
+        my $tags_raw = $guest->{tags} // '';
+        my @tags = grep { length } split(/[;,\s]+/, $tags_raw);
+
         my @nics = grep { defined $guest->{"net$_"} } 0 .. 31;
 
         push @$inventory,
             {
                 vmid => $vmid + 0,
+                tags => \@tags,
                 nics => [map { $_ + 0 } @nics],
             };
     }
-- 
2.47.3