Skip to content

Commit

Permalink
Allow webhook changes to OpenStackCluster.Spec.Bastion
Browse files Browse the repository at this point in the history 
Signed-off-by: Tobias Giese <tobias.giese@daimler.com>
  • Loading branch information
@tobiasgiese
tobiasgiese committed Dec 7, 2021
1 parent 565a051 commit a32fe32
Show file tree
Hide file tree
Showing 5 changed files with 427 additions and 0 deletions.
13 changes: 13 additions & 0 deletions api/v1alpha4/openstackcluster_webhook.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,19 @@ func (r *OpenStackCluster) ValidateUpdate(oldRaw runtime.Object) error {
r.Spec.ControlPlaneEndpoint = clusterv1.APIEndpoint{}
}

// Allow changes to the bastion spec only if no bastion host is deployed (i.e. Spec.Bastion.Enabled=false)
// or the bastion host is going to be destroyed anyway.
if old.Status.Bastion == nil || (r.Spec.Bastion != nil && r.Spec.Bastion.Enabled == false) {
old.Spec.Bastion = &Bastion{}
r.Spec.Bastion = &Bastion{}
}

// Allow toggling the bastion enabled flag.
if old.Spec.Bastion != nil && r.Spec.Bastion != nil {
old.Spec.Bastion.Enabled = true
r.Spec.Bastion.Enabled = true
}

if !reflect.DeepEqual(old.Spec, r.Spec) {
allErrs = append(allErrs, field.Forbidden(field.NewPath("spec"), "cannot be modified"))
}
Expand Down
198 changes: 198 additions & 0 deletions api/v1alpha4/openstackcluster_webhook_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,204 @@ func TestOpenStackCluster_ValidateUpdate(t *testing.T) {
},
wantErr: true,
},
{
name: "Toggle OpenStackCluster.Spec.Bastion.Enabled flag is allowed",
oldTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobar",
Image: "foobar",
Flavor: "minimal",
},
Enabled: false,
},
},
},
newTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobarbaz",
Image: "foobarbaz",
Flavor: "medium",
},
Enabled: true,
},
},
},
wantErr: false,
},
{
name: "Changing empty OpenStackCluster.Spec.Bastion is allowed",
oldTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
},
},
newTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobar",
Image: "foobar",
Flavor: "medium",
},
Enabled: true,
},
},
},
wantErr: false,
},
{
name: "Changing OpenStackCluster.Spec.Bastion with no deployed bastion host is allowed",
oldTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobar",
Image: "foobar",
Flavor: "minimal",
},
Enabled: false,
},
},
Status: OpenStackClusterStatus{},
},
newTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobarbaz",
Image: "foobarbaz",
Flavor: "medium",
},
Enabled: true,
},
},
},
wantErr: false,
},
{
name: "Changing OpenStackCluster.Spec.Bastion with deployed bastion host is not allowed",
oldTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobar",
Image: "foobar",
Flavor: "minimal",
},
Enabled: true,
},
},
Status: OpenStackClusterStatus{
Bastion: &Instance{
Name: "foobar",
},
},
},
newTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobarbaz",
Image: "foobarbaz",
Flavor: "medium",
},
Enabled: true,
},
},
},
wantErr: true,
},
{
name: "Disabling the OpenStackCluster.Spec.Bastion while it's running is allowed",
oldTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobar",
Image: "foobar",
Flavor: "minimal",
},
Enabled: true,
},
},
Status: OpenStackClusterStatus{
Bastion: &Instance{
Name: "foobar",
},
},
},
newTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobar",
Image: "foobar",
Flavor: "minimal",
},
Enabled: false,
},
},
Status: OpenStackClusterStatus{
Bastion: &Instance{
Name: "foobar",
},
},
},
wantErr: false,
},
{
name: "Disabling and changing the OpenStackCluster.Spec.Bastion while it's running is allowed",
oldTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobar",
Image: "foobar",
Flavor: "minimal",
},
Enabled: true,
},
},
Status: OpenStackClusterStatus{
Bastion: &Instance{
Name: "foobar",
},
},
},
newTemplate: &OpenStackCluster{
Spec: OpenStackClusterSpec{
CloudName: "foobar",
Bastion: &Bastion{
Instance: OpenStackMachineSpec{
CloudName: "foobarbaz",
Image: "foobarbaz",
Flavor: "medium",
},
Enabled: false,
},
},
Status: OpenStackClusterStatus{
Bastion: &Instance{
Name: "foobar",
},
},
},
wantErr: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
Expand Down
13 changes: 13 additions & 0 deletions api/v1beta1/openstackcluster_webhook.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,19 @@ func (r *OpenStackCluster) ValidateUpdate(oldRaw runtime.Object) error {
r.Spec.ControlPlaneEndpoint = clusterv1.APIEndpoint{}
}

// Allow changes to the bastion spec only if no bastion host is deployed (i.e. Spec.Bastion.Enabled=false)
// or the bastion host is going to be destroyed anyway.
if old.Status.Bastion == nil || (r.Spec.Bastion != nil && r.Spec.Bastion.Enabled == false) {
old.Spec.Bastion = &Bastion{}
r.Spec.Bastion = &Bastion{}
}

// Allow toggling the bastion enabled flag.
if old.Spec.Bastion != nil && r.Spec.Bastion != nil {
old.Spec.Bastion.Enabled = true
r.Spec.Bastion.Enabled = true
}

if !reflect.DeepEqual(old.Spec, r.Spec) {
allErrs = append(allErrs, field.Forbidden(field.NewPath("spec"), "cannot be modified"))
}
Expand Down
Loading

0 comments on commit a32fe32

Please sign in to comment.