⚠️ Rename OSM.ports[*].DisablePortSecurity to EnablePortSecurity

Invert the polarity of the port security field on PortOpts and
ResolvedPortSpecFields for consistency with positive-polarity boolean
conventions.

Author: nikParasyr

api/v1beta1/conversion.go

@@ -588,3 +588,27 @@ func ConvertAllTagsFrom(neutronTags *FilterByNeutronTags, tags, tagsAny, notTags
 	*notTags = JoinTags(neutronTags.NotTags)
 	*notTagsAny = JoinTags(neutronTags.NotTagsAny)
 }
+
+func Convert_v1beta1_ResolvedPortSpecFields_To_v1beta2_ResolvedPortSpecFields(in *ResolvedPortSpecFields, out *infrav1.ResolvedPortSpecFields, s apiconversion.Scope) error {
+	if err := autoConvert_v1beta1_ResolvedPortSpecFields_To_v1beta2_ResolvedPortSpecFields(in, out, s); err != nil {
+		return err
+	}
+
+	if in.DisablePortSecurity != nil {
+		out.EnablePortSecurity = ptr.To(!*in.DisablePortSecurity)
+	}
+
+	return nil
+}
+
+func Convert_v1beta2_ResolvedPortSpecFields_To_v1beta1_ResolvedPortSpecFields(in *infrav1.ResolvedPortSpecFields, out *ResolvedPortSpecFields, s apiconversion.Scope) error {
+	if err := autoConvert_v1beta2_ResolvedPortSpecFields_To_v1beta1_ResolvedPortSpecFields(in, out, s); err != nil {
+		return err
+	}
+
+	if in.EnablePortSecurity != nil {
+		out.DisablePortSecurity = ptr.To(!*in.EnablePortSecurity)
+	}
+
+	return nil
+}

api/v1beta1/conversion_test.go

@@ -1512,3 +1512,51 @@ func TestOpenStackCluster_RoundTrip_ExternalNetwork(t *testing.T) {
 		})
 	}
 }
+
+func TestResolvedPortSpecFields_RoundTrip_PortSecurity(t *testing.T) {
+	tests := []struct {
+		name             string
+		in               ResolvedPortSpecFields
+		expectedEnablePS *bool
+	}{
+		{
+			name: "DisablePortSecurity explicitly true",
+			in: ResolvedPortSpecFields{
+				DisablePortSecurity: ptr.To(true),
+			},
+			expectedEnablePS: ptr.To(false), // disable=true → enable=false
+		},
+		{
+			name: "DisablePortSecurity explicitly false",
+			in: ResolvedPortSpecFields{
+				DisablePortSecurity: ptr.To(false),
+			},
+			expectedEnablePS: ptr.To(true), // disable=false → enable=true
+		},
+		{
+			name:             "DisablePortSecurity unset — EnablePortSecurity stays nil",
+			in:               ResolvedPortSpecFields{},
+			expectedEnablePS: nil, // unset stays unset, inherits from network level
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
+
+			// --- Convert to v1beta2 ---
+			out := &infrav1.ResolvedPortSpecFields{}
+			g.Expect(Convert_v1beta1_ResolvedPortSpecFields_To_v1beta2_ResolvedPortSpecFields(&tt.in, out, nil)).To(Succeed())
+
+			// --- Verify intermediate v1beta2 state ---
+			g.Expect(out.EnablePortSecurity).To(Equal(tt.expectedEnablePS))
+
+			// --- Convert back to v1beta1 ---
+			restored := &ResolvedPortSpecFields{}
+			g.Expect(Convert_v1beta2_ResolvedPortSpecFields_To_v1beta1_ResolvedPortSpecFields(out, restored, nil)).To(Succeed())
+
+			// --- Verify full round-trip ---
+			g.Expect(restored.DisablePortSecurity).To(Equal(tt.in.DisablePortSecurity))
+		})
+	}
+}

api/v1beta1/zz_generated.conversion.go

@@ -84,7 +84,7 @@ type OpenStackClusterSpec struct {
 	// external networks unless EnableExternalNetwork is also set to false.
 	//
 	// If ExternalNetwork is not defined and there are no external networks
-	// the controller will proceed as though EnableExternalNetwork was set to true.
+	// the controller will proceed as though EnableExternalNetwork was set to false.
 	// +optional
 	ExternalNetwork *NetworkParam `json:"externalNetwork,omitempty"`
 

api/v1beta2/openstackcluster_types.go

@@ -424,10 +424,10 @@ type ResolvedPortSpecFields struct {
 	// +optional
 	Profile *BindingProfile `json:"profile,omitempty"`
 
-	// disablePortSecurity enables or disables the port security when set.
+	// enablePortSecurity enables or disables the port security when set.
 	// When not set, it takes the value of the corresponding field at the network level.
 	// +optional
-	DisablePortSecurity *bool `json:"disablePortSecurity,omitempty"`
+	EnablePortSecurity *bool `json:"enablePortSecurity,omitempty"`
 
 	// propagateUplinkStatus enables or disables the propagate uplink status on the port.
 	// +optional