Implement Mixed Mode State Detection

This patch introduces the Mixed Mode state detection logic for NSX Operator
to determine the network scope (T1, VPC, or VDS) it operates within. This
is critical for deciding which controllers should be activated.

Key features:
- Introduced an informer for the NetworkSettings CR in the Controller
  Runtime cache to efficiently determine the global network state.
- Added detection logic for VDS alongside T1 and VPC based on the
  NetworkSettings `provider` field.
- Implemented capability checking by reading the
  `supports_per_namespace_network_provider` key from the `status.supervisor`
  path in the Capabilities CR.
- Incorporated the `EnableVPCNetwork` configuration override to act as an
  early trigger. This solves the "chicken-and-egg" problem by allowing
  VPC-specific controllers to start before the NetworkSettings CRs are
  updated to `provider: vpc`.
- Wrapped all corresponding controller capability gates to strictly use
  the global `config.HasVPCNamespaces()` and `config.HasT1Namespaces()`
  checks.

After this change, the NSX-Operator will start VPC controllers as long as
enable_vpc_network is true. And the T1 controllers will be started when:
  (supports_per_namespace_network_provider is activated) AND (at least one NetworkingSettings CR has provider=="nsx-tier1")
OR
  (supports_per_namespace_network_provider is deactivated) AND (enable_vpc_network is false)

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: heypnus

cmd/main.go

@@ -115,7 +115,7 @@ func init() {
 
 func startServiceController(mgr manager.Manager, nsxClient *nsx.Client) {
 	// Generate webhook certificates and start refreshing webhook certificates periodically
-	if cf.CoeConfig.EnableVPCNetwork {
+	if config.HasVPCNamespaces() {
 		if err := pkgutil.GenerateWebhookCerts(); err != nil {
 			log.Error(err, "Failed to generate webhook certificates")
 			os.Exit(1)
@@ -125,7 +125,7 @@ func startServiceController(mgr manager.Manager, nsxClient *nsx.Client) {
 	}
 
 	// Initialize and start the system health reporter
-	if cf.CoeConfig.EnableVPCNetwork && cf.EnableInventory && cf.CoeConfig.EnableSha {
+	if config.HasVPCNamespaces() && cf.EnableInventory && cf.CoeConfig.EnableSha {
 		health.Start(nsxClient, cf, mgr.GetClient())
 	}
 
@@ -138,7 +138,7 @@ func startServiceController(mgr manager.Manager, nsxClient *nsx.Client) {
 
 	checkLicense(nsxClient, cf.LicenseValidationInterval)
 
-	if cf.K8sConfig.EnableRestore && cf.CoeConfig.EnableVPCNetwork {
+	if cf.K8sConfig.EnableRestore && config.HasVPCNamespaces() {
 		var err error
 		restoreMode, err = pkgutil.CompareNSXRestore(mgr.GetClient(), nsxClient)
 		if err != nil {
@@ -155,7 +155,7 @@ func startServiceController(mgr manager.Manager, nsxClient *nsx.Client) {
 	var hookServer webhook.Server
 	var subnetSetReconcile *subnetset.SubnetSetReconciler
 
-	if cf.CoeConfig.EnableVPCNetwork {
+	if config.HasVPCNamespaces() {
 		// Check NSX version for VPC networking mode
 		if !commonService.NSXClient.NSXCheckVersion(nsx.VPC) {
 			log.Error(nil, "VPC mode cannot be enabled if NSX version is lower than 4.1.1")
@@ -300,6 +300,20 @@ func startServiceController(mgr manager.Manager, nsxClient *nsx.Client) {
 		log.Error(err, "Failed to update Pod labels")
 		panic(err)
 	}
+
+	// Watch for mixed-mode state changes (e.g. T1-only → T1+VPC when the migration starts).
+	// If the state changes, exit so the operator restarts with the new configuration
+	config.StartNetworkSettingsInformer(mgr)
+	go func() {
+		ticker := time.NewTicker(30 * time.Second)
+		defer ticker.Stop()
+		for range ticker.C {
+			if config.RefreshMixedModeState(context.Background()) {
+				log.Info("Mixed-mode state changed; restarting NSX Operator to pick up new configuration")
+				os.Exit(0)
+			}
+		}
+	}()
 }
 
 func electMaster(mgr manager.Manager, nsxClient *nsx.Client) {
@@ -345,6 +359,12 @@ func main() {
 		os.Exit(1)
 	}
 
+	if err := config.InitMixedMode(context.Background(), cfg, cf.CoeConfig.EnableVPCNetwork); err != nil {
+		log.Error(err, "Failed to initialize mixed mode state")
+		os.Exit(1)
+	}
+	util.SetHasVPCNamespacesFunc(config.HasVPCNamespaces)
+
 	if cf.HAEnabled() {
 		go electMaster(mgr, nsxClient)
 	} else {