fix(config): Convert NAT configuration from K8s

The k8s conversion code was not properly setting the NAT config
even when configured in k8s making it impossible to set stateful
NAT.  This adds the conversion and some unit tests.

Signed-off-by: Manish Vachharajani <manish@githedgehog.com>

Author: mvachhar

config/src/converters/k8s/config/expose.rs

@@ -165,6 +165,24 @@ impl TryFrom<(&SubnetMap, &GatewayAgentPeeringsPeeringExpose)> for VpcExpose {
             ));
         }
 
+        vpc_expose = match &expose.nat {
+            Some(nat) => match (&nat.stateful, &nat.stateless) {
+                (Some(_), Some(_)) => {
+                    return Err(FromK8sConversionError::Invalid(
+                            "Cannot have both stateful and stateless nat configured on the same expose block".to_string(),
+                        ));
+                }
+                (Some(stateful), None) => vpc_expose
+                    .make_stateful_nat(stateful.idle_timeout)
+                    .map_err(|e| FromK8sConversionError::Invalid(e.to_string())),
+                (None, Some(_)) => vpc_expose
+                    .make_stateless_nat()
+                    .map_err(|e| FromK8sConversionError::Invalid(e.to_string())),
+                (None, None) => Ok(vpc_expose), // Rely on default behavior for NAT
+            },
+            None => Ok(vpc_expose),
+        }?;
+
         if let Some(ases) = expose.r#as.as_ref() {
             for r#as in ases {
                 vpc_expose = process_as_block(vpc_expose, r#as)?;
@@ -177,6 +195,8 @@ impl TryFrom<(&SubnetMap, &GatewayAgentPeeringsPeeringExpose)> for VpcExpose {
 
 #[cfg(test)]
 mod test {
+    use crate::external::overlay::vpcpeering::VpcExposeNatConfig;
+
     use super::*;
 
     #[test]
@@ -482,6 +502,49 @@ mod test {
                 assert_eq!(nots, k8s_nots);
                 assert_eq!(r#as, k8s_as);
                 assert_eq!(not_as, k8s_not_as);
+                match (expose.nat.as_ref(), k8s_expose.nat.as_ref()) {
+                    (Some(nat), None) => {
+                        assert!(
+                            k8s_expose.r#as.is_some(),
+                            "K8s does not have NAT set, but nat is configured: {expose}"
+                        );
+                        assert!(
+                            nat.is_stateless(),
+                            "Default NAT configured via 'as' by k8s, but nat is not stateless: {expose}"
+                        );
+                    }
+                    (None, Some(_)) => {
+                        panic!("K8s has NAT configured, but dataplane config does not")
+                    }
+                    (Some(nat), Some(k8s_nat)) => match &nat.config {
+                        VpcExposeNatConfig::Stateful(c) => {
+                            if let Some(k8s_stateful) = k8s_nat.stateful.as_ref() {
+                                if let Some(k8s_idle_timeout) = k8s_stateful.idle_timeout {
+                                    assert_eq!(c.idle_timeout, k8s_idle_timeout);
+                                } else {
+                                    assert_eq!(c.idle_timeout, std::time::Duration::new(2 * 60, 0));
+                                }
+                            } else {
+                                panic!("Stateful NAT configured but not by K8s");
+                            }
+                        }
+                        VpcExposeNatConfig::Stateless(_) => {
+                            assert!(k8s_nat.stateful.is_none(),"Stateless NAT configured but K8s configured stateful NAT: {expose:#?}\nk8s: {k8s_nat:#?}");
+                            if k8s_nat.stateless.is_none() {
+                                assert!(k8s_expose.r#as.is_some());
+                            }
+                        }
+                    },
+                    (None, None) => {
+                        if k8s_expose.r#as.is_some() {
+                            if let Some(nat) = expose.nat.as_ref() {
+                                assert!(nat.is_stateless());
+                            } else {
+                                panic!("K8s has nat configured, but dataplane config does not")
+                            }
+                        }
+                    }
+                }
             });
     }
 }

k8s-intf/src/bolero/expose.rs

@@ -126,7 +126,7 @@ impl ValueGenerator for LegalValueExposeGenerator<'_> {
         Some(GatewayAgentPeeringsPeeringExpose {
             r#as: Some(final_as).filter(|f| !f.is_empty()),
             ips: Some(final_ips).filter(|f| !f.is_empty()),
-            nat: if has_as {
+            nat: if has_as && d.produce::<bool>()? {
                 Some(
                     d.produce::<LegalValue<GatewayAgentPeeringsPeeringExposeNat>>()?
                         .take(),