Add provider compatibility matrix generator

Makefile

@@ -156,8 +156,12 @@ clean: ## Remove all generated files (bin/, dist/, coverage files)
 
 ##@ Build
 
-.PHONY: docs
-docs: crd-ref-docs ## Generate API reference documentation.
+.PHONY: compatibility-matrix
+compatibility-matrix: ## Regenerate the provider compatibility matrix (docs/provider-compatibility.md).
+	go run ./hack/provider-compatibility-matrix
+
+.PHONY: api-reference
+api-reference: crd-ref-docs ## Regenerate docs/api-reference/index.md from CRD types.
 	$(CRD_REF_DOCS) --source-path=./api --config=./hack/api-reference/config.yaml --renderer=markdown --output-path=./docs/api-reference/index.md
 	@sed -i.bak \
 		-e '/^SPDX-/d' \
@@ -169,6 +173,9 @@ docs: crd-ref-docs ## Generate API reference documentation.
 	  docs/api-reference/index.md
 	@find . -type f -name "*.bak" -delete
 
+.PHONY: docs
+docs: api-reference compatibility-matrix ## Generate API reference and provider compatibility matrix.
+
 ROOT_DIR := $(shell pwd)
 DOCS_IMG ?= ironcore-dev/network-operator-docs:latest
 

docs/index.md

@@ -19,6 +19,9 @@ hero:
         - theme: alt
           text: API Reference
           link: /api-reference/
+        - theme: alt
+          text: Vendor Compatibility
+          link: /provider-compatibility
 
 features:
     - title: 🔌 Multi-Vendor Network Automation

docs/provider-compatibility.md

@@ -0,0 +1,132 @@
+<!-- Generated by hack/provider-compatibility-matrix. DO NOT EDIT. Run `make docs`. -->
+# Vendor compatibility matrix
+
+Generated by scanning provider code for `apistatus.NewUnsupportedFieldError()` calls.
+
+Full support (✓) means no such call was found. Providers that reject a field with a plain error, or whose `EnsureX` is an intentional no-op, are indistinguishable from full support.
+
+- ✓ full  &nbsp; ~ partial  &nbsp
+
+| Resource | openconfig | cisco-nxos-gnmi | cisco-iosxr-gnmi |
+|---|---|---|---|
+| [AAA](/api-reference/#aaa) | [~](#note-aaa-openconfig) | ✓ |  |
+| [ACL](/api-reference/#accesscontrollist) | ✓ | ✓ |  |
+| [BGP](/api-reference/#bgp) | [~](#note-bgp-openconfig) | ✓ | ✓ |
+| [BGPPeer](/api-reference/#bgppeer) | [~](#note-bgppeer-openconfig) | ✓ | ✓ |
+| [Banner](/api-reference/#banner) | [~](#note-banner-openconfig) | ✓ |  |
+| [Certificate](/api-reference/#certificate) |  | ✓ |  |
+| [DHCPRelay](/api-reference/#dhcprelay) |  | ✓ |  |
+| [DNS](/api-reference/#dns) | [~](#note-dns-openconfig) | ✓ |  |
+| [EVPNInstance](/api-reference/#evpninstance) |  | ✓ |  |
+| [EthernetSegment](/api-reference/#ethernetsegment) |  | ✓ |  |
+| [ISIS](/api-reference/#isis) | [~](#note-isis-openconfig) | ✓ |  |
+| [Interface](/api-reference/#interface) | [~](#note-interface-openconfig) | [~](#note-interface-cisco-nxos-gnmi) | ✓ |
+| [LLDP](/api-reference/#lldp) | ✓ | ✓ |  |
+| [ManagementAccess](/api-reference/#managementaccess) | [~](#note-managementaccess-openconfig) | [~](#note-managementaccess-cisco-nxos-gnmi) |  |
+| [NTP](/api-reference/#ntp) |  | ✓ |  |
+| [NVE](/api-reference/#networkvirtualizationedge) |  | ✓ |  |
+| [OSPF](/api-reference/#ospf) |  | ✓ |  |
+| [PIM](/api-reference/#pim) |  | [~](#note-pim-cisco-nxos-gnmi) |  |
+| [PrefixSet](/api-reference/#prefixset) | ✓ | ✓ | ✓ |
+| [RoutingPolicy](/api-reference/#routingpolicy) | [~](#note-routingpolicy-openconfig) | ✓ |  |
+| [SNMP](/api-reference/#snmp) |  | ✓ |  |
+| [Syslog](/api-reference/#syslog) | [~](#note-syslog-openconfig) | ✓ |  |
+| [User](/api-reference/#user) |  | ✓ |  |
+| [VLAN](/api-reference/#vlan) |  | ✓ |  |
+| [VRF](/api-reference/#vrf) | [~](#note-vrf-openconfig) | ✓ | ✓ |
+
+## List of resources with incomplete support
+
+### openconfig
+
+<a id="note-aaa-openconfig"></a>
+**AAA**
+
+- `spec.authorization`
+- `spec.serverGroups[].type`
+
+<a id="note-bgp-openconfig"></a>
+**BGP**
+
+- `spec.addressFamilies`
+- `spec.addressFamilies.l2vpnEvpn`
+- `spec.adminState`
+
+<a id="note-bgppeer-openconfig"></a>
+**BGPPeer**
+
+- `spec.addressFamilies.l2vpnEvpn`
+- `spec.localAS.prependGlobalAS`
+- `spec.localAS.prependLocalAS`
+
+<a id="note-banner-openconfig"></a>
+**Banner**
+
+- `spec.type`
+
+<a id="note-dns-openconfig"></a>
+**DNS**
+
+- `spec.adminState`
+- `spec.servers[].vrfName`
+- `spec.sourceInterfaceName`
+
+<a id="note-isis-openconfig"></a>
+**ISIS**
+
+- `spec.type`
+
+<a id="note-interface-openconfig"></a>
+**Interface**
+
+- `spec.aggregation.multichassis`
+- `spec.bfd`
+- `spec.encapsulation.type`
+- `spec.ethernet.fecMode`
+- `spec.switchport`
+- `spec.switchport.mode`
+- `spec.type`
+
+<a id="note-managementaccess-openconfig"></a>
+**ManagementAccess**
+
+- `spec.grpc.gnmi`
+- `spec.ssh.sessionLimit`
+
+<a id="note-routingpolicy-openconfig"></a>
+**RoutingPolicy**
+
+- `spec.statements[].actions.bgpActions.setASPath`
+- `spec.statements[].actions.bgpActions.setCommunity`
+- `spec.statements[].actions.bgpActions.setExtCommunity`
+
+<a id="note-syslog-openconfig"></a>
+**Syslog**
+
+- `spec.facilities`
+- `spec.servers[].vrfName`
+
+<a id="note-vrf-openconfig"></a>
+**VRF**
+
+- `spec.routeDistinguisher`
+- `spec.routeTargets`
+- `spec.vni`
+
+### cisco-nxos-gnmi
+
+<a id="note-interface-cisco-nxos-gnmi"></a>
+**Interface**
+
+- `spec.type`
+
+<a id="note-managementaccess-cisco-nxos-gnmi"></a>
+**ManagementAccess**
+
+- `spec.grpc.serverName`
+
+<a id="note-pim-cisco-nxos-gnmi"></a>
+**PIM**
+
+- `spec.interfaces[*].mode`
+

hack/api-reference/config.yaml

@@ -3,7 +3,13 @@ processor:
     - "TypeMeta$"
   ignoreTypes:
     - "ParseError$"
-    - "List$"
+    # Exclude Kubernetes list wrapper types (FooList). Three patterns together
+    # cover all wrappers without accidentally excluding AccessControlList which
+    # is a root CRD type (its wrapper AccessControlListList is caught by the
+    # first pattern).
+    - "ListList$"
+    - "PoolList$"
+    - "[^l]List$"
 
 render:
   kubernetesVersion: 1.35