Fix security group rules comparison

Author: Tomy2e

api/v1beta1/scalewaycluster_webhook.go

@@ -4,6 +4,7 @@ import (
 	"net"
 	"reflect"
 
+	"github.com/scaleway/scaleway-sdk-go/api/instance/v1"
 	"github.com/scaleway/scaleway-sdk-go/scw"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -238,14 +239,20 @@ func (r *ScalewayCluster) validateSecurityGroupPolicy(sgp *SecurityGroupPolicy,
 			return field.Invalid(innerPath.Child("action"), rule.Action, err.Error())
 		}
 
-		if _, err := rule.Protocol.ToInstance(); err != nil {
+		proto, err := rule.Protocol.ToInstance()
+		if err != nil {
 			return field.Invalid(innerPath.Child("protocol"), rule.Protocol, err.Error())
 		}
 
 		if _, _, err := rule.Ports.ToRange(); err != nil {
 			return field.Invalid(innerPath.Child("ports"), rule.Ports, err.Error())
 		}
 
+		// When using ANY or ICMP, ports must be nil.
+		if (proto == instance.SecurityGroupRuleProtocolANY || proto == instance.SecurityGroupRuleProtocolICMP) && rule.Ports != nil {
+			return field.Invalid(innerPath.Child("ports"), rule.Ports, "ports must not be set when using ANY or ICMP protocols")
+		}
+
 		if rule.IPRange != nil {
 			if _, _, err := net.ParseCIDR(*rule.IPRange); err != nil {
 				return field.Invalid(innerPath.Child("ipRange"), rule.IPRange, err.Error())

internal/service/scaleway/securitygroup/securitygroup.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"reflect"
 
 	"github.com/Tomy2e/cluster-api-provider-scaleway/api/v1beta1"
 	"github.com/Tomy2e/cluster-api-provider-scaleway/internal/scope"
@@ -72,11 +73,11 @@ func compareRules(a []v1beta1.SecurityGroupRule, b []*instance.SecurityGroupRule
 			return false, err
 		}
 
-		if from != b[i].DestPortFrom {
+		if !reflect.DeepEqual(from, b[i].DestPortFrom) {
 			return false, nil
 		}
 
-		if to != b[i].DestPortTo {
+		if !reflect.DeepEqual(to, b[i].DestPortTo) {
 			return false, nil
 		}
 	}
@@ -278,7 +279,12 @@ func (s *Service) ensureSecurityGroups(ctx context.Context, securityGroups []v1b
 					return fmt.Errorf("failed to set security group rules: %w", err)
 				}
 
-				l.Info("security group rules were updated", "securityGroupName", s.SecurityGroupName(sg.Name))
+				l.Info(
+					"security group rules were updated",
+					"securityGroupName", s.SecurityGroupName(sg.Name),
+					"compareInbound", compareInbound,
+					"compareOutbound", compareOutbound,
+				)
 			}
 		}
 	}