Merge pull request #362 from JoelSpeed/prevent-nlb-clb-switch

OCPBUGS-16728: Add admission policy to deny changing an AWS LB type on an existing service

Author: openshift-merge-bot[bot]

pkg/cloud/aws/assets/validating-admission-policy-binding.yaml

@@ -0,0 +1,7 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: openshift-cloud-controller-manager-cloud-provider-aws
+spec:
+  policyName: openshift-cloud-controller-manager-cloud-provider-aws
+  validationActions: ["Deny"]

pkg/cloud/aws/assets/validating-admission-policy.yaml

@@ -0,0 +1,20 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: openshift-cloud-controller-manager-cloud-provider-aws
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:   [""]
+      apiVersions: ["v1"]
+      operations:  ["UPDATE"]
+      resources:   ["services"]
+  validations:
+    - expression: |
+        (has(object.metadata.annotations) && 'service.beta.kubernetes.io/aws-load-balancer-type' in object.metadata.annotations) ==
+          (has(oldObject.metadata.annotations) && 'service.beta.kubernetes.io/aws-load-balancer-type' in oldObject.metadata.annotations) &&
+          (has(object.metadata.annotations) && 'service.beta.kubernetes.io/aws-load-balancer-type' in object.metadata.annotations ?
+          object.metadata.annotations['service.beta.kubernetes.io/aws-load-balancer-type'] == oldObject.metadata.annotations['service.beta.kubernetes.io/aws-load-balancer-type'] : true)
+      message: "The annotation 'service.beta.kubernetes.io/aws-load-balancer-type' may not be added, removed, or have its value changed. Changing the type of an existing load balancer is not supported."
+      reason: Invalid

pkg/cloud/aws/aws.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 
 	"github.com/asaskevich/govalidator"
+	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
 	appsv1 "k8s.io/api/apps/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
@@ -20,6 +21,8 @@ var (
 
 	templates = []common.TemplateSource{
 		{ReferenceObject: &appsv1.Deployment{}, EmbedFsPath: "assets/deployment.yaml"},
+		{ReferenceObject: &admissionregistrationv1.ValidatingAdmissionPolicy{}, EmbedFsPath: "assets/validating-admission-policy.yaml"},
+		{ReferenceObject: &admissionregistrationv1.ValidatingAdmissionPolicyBinding{}, EmbedFsPath: "assets/validating-admission-policy-binding.yaml"},
 	}
 )
 

pkg/cloud/aws/aws_test.go

@@ -43,7 +43,7 @@ func TestResourcesRenderingSmoke(t *testing.T) {
 			}
 
 			resources := assets.GetRenderedResources()
-			assert.Len(t, resources, 1)
+			assert.Len(t, resources, 3)
 		})
 	}
 }

pkg/cloud/cloud_test.go

@@ -99,20 +99,24 @@ func TestGetResources(t *testing.T) {
 	}{{
 		name:                  "AWS resources returned as expected",
 		testPlatform:          platformsMap[string(configv1.AWSPlatformType)],
-		expectedResourceCount: 3,
+		expectedResourceCount: 5,
 		expectedResourcesKindName: []string{
 			"Deployment/aws-cloud-controller-manager",
+			"ValidatingAdmissionPolicy/openshift-cloud-controller-manager-cloud-provider-aws",
+			"ValidatingAdmissionPolicyBinding/openshift-cloud-controller-manager-cloud-provider-aws",
 			"PodDisruptionBudget/aws-cloud-controller-manager",
 			"Service/aws-cloud-controller-manager",
 		},
 	}, {
 		name:                  "AWS resources returned as expected with single node cluster",
 		testPlatform:          platformsMap[string(configv1.AWSPlatformType)],
-		expectedResourceCount: 2,
+		expectedResourceCount: 4,
 		singleReplica:         true,
 		expectedResourcesKindName: []string{
 			"Deployment/aws-cloud-controller-manager",
 			"Service/aws-cloud-controller-manager",
+			"ValidatingAdmissionPolicy/openshift-cloud-controller-manager-cloud-provider-aws",
+			"ValidatingAdmissionPolicyBinding/openshift-cloud-controller-manager-cloud-provider-aws",
 		},
 	}, {
 		name:                  "OpenStack resources returned as expected",