feat(mariadb): let the external endpoint wear a reserved address

Which Service actually receives the address depends on the replica count: the
operator publishes the cluster Service for a single replica and primaryService
once there are more, and the chart already branches on exactly that. The claim
annotation follows the same branch, so a tenant writes one entry either way.

Assisted-by: LLM
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

api/apps/v1alpha1/mariadb/types.go

@@ -36,6 +36,9 @@ type ConfigSpec struct {
 	// Enable external access from outside the cluster.
 	// +kubebuilder:default:=false
 	External bool `json:"external"`
+	// Reserved addresses for the endpoints `external: true` publishes. Each entry pins one endpoint to an address held by an IPAddressClaim, so the address survives a rebuild of this application. Empty lets the load balancer assign any free address, as before.
+	// +kubebuilder:default:={}
+	ExternalIPs []ExternalIP `json:"externalIPs,omitempty"`
 	// TLS configuration. Selects who issues the certificates and whether plaintext is refused; TLS itself is always served.
 	// +kubebuilder:default:={}
 	Tls TLS `json:"tls,omitempty"`
@@ -92,6 +95,13 @@ type DatabaseRoles struct {
 	Readonly []string `json:"readonly,omitempty"`
 }
 
+type ExternalIP struct {
+	// Name of an IPAddressClaim in this namespace whose address the endpoint should wear. Until the claim binds, the endpoint keeps whatever address the load balancer assigned.
+	Claim string `json:"claim"`
+	// Which external endpoint to pin. `primary` is the read-write endpoint, the endpoint `external: true` publishes, and is the default.
+	Target string `json:"target,omitempty"`
+}
+
 type Resources struct {
 	// CPU available to each replica.
 	Cpu resource.Quantity `json:"cpu,omitempty"`