From b5eb475e72fc1fd9f5e3f7d0e6206a39989902e3 Mon Sep 17 00:00:00 2001 From: Jon Huhn Date: Fri, 6 Oct 2023 11:36:34 -0500 Subject: [PATCH] fix webhook for CNI overlay --- .../azuremanagedcontrolplane_webhook.go | 6 +++-- .../azuremanagedcontrolplane_webhook_test.go | 24 +++++++++++++++++++ 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/api/v1beta1/azuremanagedcontrolplane_webhook.go b/api/v1beta1/azuremanagedcontrolplane_webhook.go index 2dbdbf904d0..ccf9d6178e5 100644 --- a/api/v1beta1/azuremanagedcontrolplane_webhook.go +++ b/api/v1beta1/azuremanagedcontrolplane_webhook.go @@ -588,8 +588,10 @@ func (m *AzureManagedControlPlane) validateVirtualNetworkUpdate(old *AzureManage func (m *AzureManagedControlPlane) validateNetworkPluginModeUpdate(old *AzureManagedControlPlane) field.ErrorList { var allErrs field.ErrorList - if ptr.Deref(m.Spec.NetworkPluginMode, "") == NetworkPluginModeOverlay && old.Spec.NetworkPolicy != nil { - allErrs = append(allErrs, field.Forbidden(field.NewPath("Spec", "NetworkPluginMode"), fmt.Sprintf("%q NetworkPolicyMode cannot be enabled when NetworkPolicy is set", NetworkPluginModeOverlay))) + if ptr.Deref(old.Spec.NetworkPluginMode, "") != NetworkPluginModeOverlay && + ptr.Deref(m.Spec.NetworkPluginMode, "") == NetworkPluginModeOverlay && + old.Spec.NetworkPolicy != nil { + allErrs = append(allErrs, field.Forbidden(field.NewPath("Spec", "NetworkPluginMode"), fmt.Sprintf("%q NetworkPluginMode cannot be enabled when NetworkPolicy is set", NetworkPluginModeOverlay))) } return allErrs diff --git a/api/v1beta1/azuremanagedcontrolplane_webhook_test.go b/api/v1beta1/azuremanagedcontrolplane_webhook_test.go index 9aee6064d1c..4e0107ca415 100644 --- a/api/v1beta1/azuremanagedcontrolplane_webhook_test.go +++ b/api/v1beta1/azuremanagedcontrolplane_webhook_test.go @@ -1556,6 +1556,7 @@ func TestAzureManagedControlPlane_ValidateUpdate(t *testing.T) { Name: "test-cluster", }, Spec: AzureManagedControlPlaneSpec{ + NetworkPolicy: ptr.To("anything"), NetworkPluginMode: ptr.To(NetworkPluginModeOverlay), }, }, @@ -1583,6 +1584,29 @@ func TestAzureManagedControlPlane_ValidateUpdate(t *testing.T) { }, wantErr: false, }, + { + name: "NetworkPolicy is allowed when NetworkPluginMode is not changed", + oldAMCP: &AzureManagedControlPlane{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-cluster", + }, + Spec: AzureManagedControlPlaneSpec{ + NetworkPolicy: ptr.To("anything"), + NetworkPluginMode: ptr.To(NetworkPluginModeOverlay), + }, + }, + amcp: &AzureManagedControlPlane{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-cluster", + }, + Spec: AzureManagedControlPlaneSpec{ + NetworkPolicy: ptr.To("anything"), + NetworkPluginMode: ptr.To(NetworkPluginModeOverlay), + Version: "v0.0.0", + }, + }, + wantErr: false, + }, { name: "AzureManagedControlPlane OIDCIssuerProfile.Enabled false -> false OK", oldAMCP: &AzureManagedControlPlane{