[GEP-7] Adds check for seed provider type when changing the seed name of shoot

plugin/pkg/shoot/validator/admission.go

@@ -238,8 +238,18 @@ func (v *ValidateShoot) Admit(ctx context.Context, a admission.Attributes, o adm
 	}
 
 	if oldShoot.Spec.SeedName != nil && !apiequality.Semantic.DeepEqual(shoot.Spec.SeedName, oldShoot.Spec.SeedName) &&
-		seed != nil && seed.Spec.Backup == nil {
-		return admission.NewForbidden(a, fmt.Errorf("cannot change seed name, because seed backup is not configured, for shoot %q", shoot.Name))
+		seed != nil {
+		if seed.Spec.Backup == nil {
+			return admission.NewForbidden(a, fmt.Errorf("cannot change seed name, because seed backup is not configured, for shoot %q", shoot.Name))
+		}
+
+		oldSeed, err := v.seedLister.Get(*oldShoot.Spec.SeedName)
+		if err != nil {
+			return apierrors.NewBadRequest(fmt.Sprintf("could not find referenced seed: %+v", err.Error()))
+		}
+		if oldSeed.Spec.Provider.Type != seed.Spec.Provider.Type {
+			return admission.NewForbidden(a, fmt.Errorf("cannot change seed name, because cloud provider for new seed (%s) is not equal to cloud provider for old seed (%s)", seed.Spec.Provider.Type, oldSeed.Spec.Provider.Type))
+		}
 	}
 
 	if shoot.Spec.Provider.Type != cloudProfile.Spec.Type {

plugin/pkg/shoot/validator/admission_test.go

@@ -1945,7 +1945,7 @@ var _ = Describe("validator", func() {
 		})
 
 		Context("backup configuration on seed", func() {
-			It("it should allow new Shoot creation when Seed doesn't have configuration for backup", func() {
+			It("should allow new Shoot creation when Seed doesn't have configuration for backup", func() {
 				oldShoot := shoot.DeepCopy()
 				oldShoot.Spec.SeedName = nil
 				seed.Spec.Backup = nil
@@ -1959,8 +1959,10 @@ var _ = Describe("validator", func() {
 
 				Expect(err).ToNot(HaveOccurred())
 			})
+		})
 
-			It("it should fail to change Seed name, because Seed doesn't have configuration for backup", func() {
+		Context("control plane migration", func() {
+			It("should fail to change Seed name, because Seed doesn't have configuration for backup", func() {
 				oldShoot := shoot.DeepCopy()
 				oldShoot.Spec.SeedName = pointer.StringPtr("oldSeedName")
 				seed.Spec.Backup = nil
@@ -1974,6 +1976,27 @@ var _ = Describe("validator", func() {
 
 				Expect(err).To(HaveOccurred())
 			})
+
+			It("should fail to change Seed name, because cloud provider for new Seed is not equal to cloud provider for old Seed", func() {
+				oldSeedName := fmt.Sprintf("old-%s", seedName)
+				oldSeed := seed.DeepCopy()
+				oldSeed.Name = oldSeedName
+				oldSeed.Spec.Provider.Type = "gcp"
+				seed.Spec.Provider.Type = "aws"
+
+				oldShoot := shoot.DeepCopy()
+				oldShoot.Spec.SeedName = &oldSeedName
+
+				Expect(coreInformerFactory.Core().InternalVersion().Projects().Informer().GetStore().Add(&project)).To(Succeed())
+				Expect(coreInformerFactory.Core().InternalVersion().CloudProfiles().Informer().GetStore().Add(&cloudProfile)).To(Succeed())
+				Expect(coreInformerFactory.Core().InternalVersion().Seeds().Informer().GetStore().Add(&seed)).To(Succeed())
+				Expect(coreInformerFactory.Core().InternalVersion().Seeds().Informer().GetStore().Add(oldSeed)).To(Succeed())
+				attrs := admission.NewAttributesRecord(&shoot, oldShoot, core.Kind("Shoot").WithVersion("version"), shoot.Namespace, shoot.Name, core.Resource("shoots").WithVersion("version"), "", admission.Update, &metav1.UpdateOptions{}, false, nil)
+
+				err := admissionHandler.Admit(context.TODO(), attrs, nil)
+
+				Expect(err).To(HaveOccurred())
+			})
 		})
 	})
 })