From 875942ae64d7253d9de9a4194a792d3393de4aad Mon Sep 17 00:00:00 2001
From: Justin Santa Barbara <justin@fathomdb.com>
Date: Sat, 24 Mar 2018 13:53:17 -0400
Subject: [PATCH] Validation: don't expect bastion nodes to join

Fix #4761
---
 pkg/validation/validate_cluster.go      | 18 +++++++---
 pkg/validation/validate_cluster_test.go | 46 +++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 5 deletions(-)

diff --git a/pkg/validation/validate_cluster.go b/pkg/validation/validate_cluster.go
index 044184deade2a..840ffee773ae9 100644
--- a/pkg/validation/validate_cluster.go
+++ b/pkg/validation/validate_cluster.go
@@ -219,11 +219,19 @@ func (v *ValidationCluster) validateNodes(cloudGroups map[string]*cloudinstances
 			node := member.Node
 
 			if node == nil {
-				v.addError(&ValidationError{
-					Kind:    "Machine",
-					Name:    member.ID,
-					Message: fmt.Sprintf("machine %q has not yet joined cluster", member.ID),
-				})
+				nodeExpectedToJoin := true
+				if cloudGroup.InstanceGroup.Spec.Role == kops.InstanceGroupRoleBastion {
+					// bastion nodes don't join the cluster
+					nodeExpectedToJoin = false
+				}
+
+				if nodeExpectedToJoin {
+					v.addError(&ValidationError{
+						Kind:    "Machine",
+						Name:    member.ID,
+						Message: fmt.Sprintf("machine %q has not yet joined cluster", member.ID),
+					})
+				}
 				continue
 			}
 
diff --git a/pkg/validation/validate_cluster_test.go b/pkg/validation/validate_cluster_test.go
index e893201f47c96..d589253d14235 100644
--- a/pkg/validation/validate_cluster_test.go
+++ b/pkg/validation/validate_cluster_test.go
@@ -184,3 +184,49 @@ func makePodList(pods []map[string]string) *v1.PodList {
 	}
 	return &list
 }
+
+func Test_ValidateBastionNodes(t *testing.T) {
+	groups := make(map[string]*cloudinstances.CloudInstanceGroup)
+	groups["ig1"] = &cloudinstances.CloudInstanceGroup{
+		InstanceGroup: &kopsapi.InstanceGroup{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "ig1",
+			},
+			Spec: kopsapi.InstanceGroupSpec{
+				Role: kopsapi.InstanceGroupRoleNode,
+			},
+		},
+		Ready: []*cloudinstances.CloudInstanceGroupMember{
+			{
+				ID:   "i-00001",
+				Node: nil,
+			},
+		},
+	}
+
+	// When an instancegroup's nodes are not ready, that is an error
+	{
+		v := &ValidationCluster{}
+		groups["ig1"].InstanceGroup.Spec.Role = kopsapi.InstanceGroupRoleNode
+		v.validateNodes(groups)
+		if len(v.Failures) != 1 {
+			printDebug(t, v)
+			t.Fatal("Nodes are expected to join cluster")
+		} else if v.Failures[0].Message != "machine \"i-00001\" has not yet joined cluster" {
+			printDebug(t, v)
+			t.Fatalf("unexpected validation failure: %+v", v.Failures[0])
+		}
+	}
+
+	// Except for a bastion instancegroup - those are not expected to join as nodes
+	{
+		v := &ValidationCluster{}
+		groups["ig1"].InstanceGroup.Spec.Role = kopsapi.InstanceGroupRoleBastion
+		v.validateNodes(groups)
+		if len(v.Failures) != 0 {
+			printDebug(t, v)
+			t.Fatal("Bastion nodes are not expected to join cluster")
+		}
+	}
+
+}