fix: always allow to add new isolation rule (#375)

metal-stack · Feb 2, 2024 · aa7981f · aa7981f
1 parent 5a1d023
commit aa7981f
Show file tree

Hide file tree

Showing 2 changed files with 45 additions and 1 deletion.
diff --git a/pkg/apis/metal/validation/cloudprofile.go b/pkg/apis/metal/validation/cloudprofile.go
@@ -146,7 +146,7 @@ func ValidateImmutableCloudProfileConfig(
 				continue
 			}
 
-			if partition.NetworkIsolation == nil && oldPartition.NetworkIsolation == nil {
+			if oldPartition.NetworkIsolation == nil {
 				continue
 			}
 

diff --git a/pkg/apis/metal/validation/cloudprofile_test.go b/pkg/apis/metal/validation/cloudprofile_test.go
@@ -398,6 +398,50 @@ var _ = Describe("CloudProfileConfig validation", func() {
 			Expect(errorList).To(BeEmpty())
 		})
 
+		It("should pass when isolation not existing previously", func() {
+			newCloudProfileConfig.MetalControlPlanes = map[string]apismetal.MetalControlPlane{
+				"prod": {
+					Partitions: map[string]apismetal.Partition{
+						"partition-b": {
+							NetworkIsolation: &apismetal.NetworkIsolation{
+								AllowedNetworks: apismetal.AllowedNetworks{
+									Ingress: []string{"10.0.0.1/24"},
+									Egress:  []string{"100.0.0.1/24"},
+								},
+								DNSServers: []string{"1.1.1.1", "1.0.0.1"},
+								NTPServers: []string{"134.60.1.27", "134.60.111.110"},
+								RegistryMirrors: []apismetal.RegistryMirror{
+									{
+										Name:     "metal-stack registry",
+										Endpoint: "https://some.registry",
+										IP:       "1.2.3.4",
+										Port:     443,
+										MirrorOf: []string{
+											"ghcr.io",
+											"quay.io",
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			}
+			oldCloudProfileConfig.MetalControlPlanes = map[string]apismetal.MetalControlPlane{
+				"prod": {
+					Partitions: map[string]apismetal.Partition{
+						"partition-b": {
+							NetworkIsolation: nil,
+						},
+					},
+				},
+			}
+
+			errorList := ValidateImmutableCloudProfileConfig(newCloudProfileConfig, oldCloudProfileConfig, path)
+
+			Expect(errorList).To(BeEmpty())
+		})
+
 		It("should pass when changing anything except dns", func() {
 			newCloudProfileConfig.MetalControlPlanes = map[string]apismetal.MetalControlPlane{
 				"prod": {