Skip to content

Commit 859a81e

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #3364 from jackfrancis/cherry-pick-3359-to-release-1.8
[release-1.8] remove strict AKS create validations for spec.controlPlaneEndpoint
2 parents 5af14ff + 62df033 commit 859a81e

File tree

7 files changed

+24
-191
lines changed

7 files changed

+24
-191
lines changed

‎api/v1beta1/azuremanagedcluster_webhook.go‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ import (
2525
"k8s.io/apimachinery/pkg/util/validation/field"
2626
"sigs.k8s.io/cluster-api-provider-azure/feature"
2727
"sigs.k8s.io/cluster-api-provider-azure/util/maps"
28-
webhookutils "sigs.k8s.io/cluster-api-provider-azure/util/webhook"
2928
capifeature "sigs.k8s.io/cluster-api/feature"
3029
ctrl "sigs.k8s.io/controller-runtime"
3130
"sigs.k8s.io/controller-runtime/pkg/webhook"
@@ -52,18 +51,6 @@ func (r *AzureManagedCluster) ValidateCreate() error {
5251
"can be set only if the Cluster API 'MachinePool' feature flag is enabled",
5352
)
5453
}
55-
if r.Spec.ControlPlaneEndpoint.Host != "" {
56-
return field.Forbidden(
57-
field.NewPath("Spec", "ControlPlaneEndpoint", "Host"),
58-
controlPlaneEndpointErrorMessage,
59-
)
60-
}
61-
if r.Spec.ControlPlaneEndpoint.Port != 0 {
62-
return field.Forbidden(
63-
field.NewPath("Spec", "ControlPlaneEndpoint", "Port"),
64-
controlPlaneEndpointErrorMessage,
65-
)
66-
}
6754
return nil
6855
}
6956

@@ -83,24 +70,6 @@ func (r *AzureManagedCluster) ValidateUpdate(oldRaw runtime.Object) error {
8370
fmt.Sprintf("annotations with '%s' prefix are immutable", CustomHeaderPrefix)))
8471
}
8572

86-
if old.Spec.ControlPlaneEndpoint.Host != "" {
87-
if err := webhookutils.ValidateImmutable(
88-
field.NewPath("Spec", "ControlPlaneEndpoint", "Host"),
89-
old.Spec.ControlPlaneEndpoint.Host,
90-
r.Spec.ControlPlaneEndpoint.Host); err != nil {
91-
allErrs = append(allErrs, err)
92-
}
93-
}
94-
95-
if old.Spec.ControlPlaneEndpoint.Port != 0 {
96-
if err := webhookutils.ValidateImmutable(
97-
field.NewPath("Spec", "ControlPlaneEndpoint", "Port"),
98-
old.Spec.ControlPlaneEndpoint.Port,
99-
r.Spec.ControlPlaneEndpoint.Port); err != nil {
100-
allErrs = append(allErrs, err)
101-
}
102-
}
103-
10473
if len(allErrs) != 0 {
10574
return apierrors.NewInvalid(GroupVersion.WithKind("AzureManagedCluster").GroupKind(), r.Name, allErrs)
10675
}

‎api/v1beta1/azuremanagedcluster_webhook_test.go‎

Lines changed: 8 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -122,13 +122,12 @@ func TestAzureManagedCluster_ValidateUpdate(t *testing.T) {
122122
wantErr: false,
123123
},
124124
{
125-
name: "ControlPlaneEndpoint.Port is immutable",
125+
name: "ControlPlaneEndpoint.Port update (AKS API-derived update scenario)",
126126
oldAMC: &AzureManagedCluster{
127127
ObjectMeta: metav1.ObjectMeta{},
128128
Spec: AzureManagedClusterSpec{
129129
ControlPlaneEndpoint: clusterv1.APIEndpoint{
130130
Host: "aks-8622-h4h26c44.hcp.eastus.azmk8s.io",
131-
Port: 443,
132131
},
133132
},
134133
},
@@ -137,42 +136,22 @@ func TestAzureManagedCluster_ValidateUpdate(t *testing.T) {
137136
Spec: AzureManagedClusterSpec{
138137
ControlPlaneEndpoint: clusterv1.APIEndpoint{
139138
Host: "aks-8622-h4h26c44.hcp.eastus.azmk8s.io",
140-
Port: 444,
139+
Port: 443,
141140
},
142141
},
143142
},
144-
wantErr: true,
143+
wantErr: false,
145144
},
146145
{
147-
name: "ControlPlaneEndpoint.Host is immutable",
146+
name: "ControlPlaneEndpoint.Host update (AKS API-derived update scenario)",
148147
oldAMC: &AzureManagedCluster{
149148
ObjectMeta: metav1.ObjectMeta{},
150149
Spec: AzureManagedClusterSpec{
151150
ControlPlaneEndpoint: clusterv1.APIEndpoint{
152-
Host: "aks-8622-h4h26c44.hcp.eastus.azmk8s.io",
153151
Port: 443,
154152
},
155153
},
156154
},
157-
amc: &AzureManagedCluster{
158-
ObjectMeta: metav1.ObjectMeta{},
159-
Spec: AzureManagedClusterSpec{
160-
ControlPlaneEndpoint: clusterv1.APIEndpoint{
161-
Host: "this-is-not-allowed",
162-
Port: 443,
163-
},
164-
},
165-
},
166-
wantErr: true,
167-
},
168-
{
169-
name: "ControlPlaneEndpoint update from zero values are allowed",
170-
oldAMC: &AzureManagedCluster{
171-
ObjectMeta: metav1.ObjectMeta{},
172-
Spec: AzureManagedClusterSpec{
173-
ControlPlaneEndpoint: clusterv1.APIEndpoint{},
174-
},
175-
},
176155
amc: &AzureManagedCluster{
177156
ObjectMeta: metav1.ObjectMeta{},
178157
Spec: AzureManagedClusterSpec{
@@ -211,26 +190,26 @@ func TestAzureManagedCluster_ValidateCreate(t *testing.T) {
211190
wantErr bool
212191
}{
213192
{
214-
name: "can't set Spec.ControlPlaneEndpoint.Host during create",
193+
name: "can set Spec.ControlPlaneEndpoint.Host during create (clusterctl move scenario)",
215194
amc: &AzureManagedCluster{
216195
Spec: AzureManagedClusterSpec{
217196
ControlPlaneEndpoint: clusterv1.APIEndpoint{
218197
Host: "my-host",
219198
},
220199
},
221200
},
222-
wantErr: true,
201+
wantErr: false,
223202
},
224203
{
225-
name: "can't set Spec.ControlPlaneEndpoint.Port during create",
204+
name: "can set Spec.ControlPlaneEndpoint.Port during create (clusterctl move scenario)",
226205
amc: &AzureManagedCluster{
227206
Spec: AzureManagedClusterSpec{
228207
ControlPlaneEndpoint: clusterv1.APIEndpoint{
229208
Port: 4443,
230209
},
231210
},
232211
},
233-
wantErr: true,
212+
wantErr: false,
234213
},
235214
}
236215
for _, tc := range tests {

‎api/v1beta1/azuremanagedcontrolplane_webhook.go‎

Lines changed: 5 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,11 @@ import (
4141
)
4242

4343
var (
44-
kubeSemver = regexp.MustCompile(`^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)([-0-9a-zA-Z_\.+]*)?$`)
45-
controlPlaneEndpointErrorMessage = "can not be set by the user, will be set automatically by AKS after the cluster is Ready"
46-
rMaxNodeProvisionTime = regexp.MustCompile(`^(\d+)m$`)
47-
rScaleDownTime = regexp.MustCompile(`^(\d+)m$`)
48-
rScaleDownDelayAfterDelete = regexp.MustCompile(`^(\d+)s$`)
49-
rScanInterval = regexp.MustCompile(`^(\d+)s$`)
44+
kubeSemver = regexp.MustCompile(`^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)([-0-9a-zA-Z_\.+]*)?$`)
45+
rMaxNodeProvisionTime = regexp.MustCompile(`^(\d+)m$`)
46+
rScaleDownTime = regexp.MustCompile(`^(\d+)m$`)
47+
rScaleDownDelayAfterDelete = regexp.MustCompile(`^(\d+)s$`)
48+
rScanInterval = regexp.MustCompile(`^(\d+)s$`)
5049
)
5150

5251
// SetupWebhookWithManager sets up and registers the webhook with the manager.
@@ -98,19 +97,6 @@ func (m *AzureManagedControlPlane) ValidateCreate(client client.Client) error {
9897
)
9998
}
10099

101-
if m.Spec.ControlPlaneEndpoint.Host != "" {
102-
return field.Forbidden(
103-
field.NewPath("Spec", "ControlPlaneEndpoint", "Host"),
104-
controlPlaneEndpointErrorMessage,
105-
)
106-
}
107-
if m.Spec.ControlPlaneEndpoint.Port != 0 {
108-
return field.Forbidden(
109-
field.NewPath("Spec", "ControlPlaneEndpoint", "Port"),
110-
controlPlaneEndpointErrorMessage,
111-
)
112-
}
113-
114100
return m.Validate(client)
115101
}
116102

@@ -207,24 +193,6 @@ func (m *AzureManagedControlPlane) ValidateUpdate(oldRaw runtime.Object, client
207193
}
208194
}
209195

210-
if old.Spec.ControlPlaneEndpoint.Host != "" {
211-
if err := webhookutils.ValidateImmutable(
212-
field.NewPath("Spec", "ControlPlaneEndpoint", "Host"),
213-
old.Spec.ControlPlaneEndpoint.Host,
214-
m.Spec.ControlPlaneEndpoint.Host); err != nil {
215-
allErrs = append(allErrs, err)
216-
}
217-
}
218-
219-
if old.Spec.ControlPlaneEndpoint.Port != 0 {
220-
if err := webhookutils.ValidateImmutable(
221-
field.NewPath("Spec", "ControlPlaneEndpoint", "Port"),
222-
old.Spec.ControlPlaneEndpoint.Port,
223-
m.Spec.ControlPlaneEndpoint.Port); err != nil {
224-
allErrs = append(allErrs, err)
225-
}
226-
}
227-
228196
// Consider removing this once moves out of preview
229197
// Updating outboundType after cluster creation (PREVIEW)
230198
// https://learn.microsoft.com/en-us/azure/aks/egress-outboundtype#updating-outboundtype-after-cluster-creation-preview

‎api/v1beta1/azuremanagedcontrolplane_webhook_test.go‎

Lines changed: 4 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -630,7 +630,7 @@ func TestAzureManagedControlPlane_ValidateCreate(t *testing.T) {
630630
errorLen: 1,
631631
},
632632
{
633-
name: "can't set Spec.ControlPlaneEndpoint.Host during create",
633+
name: "can set Spec.ControlPlaneEndpoint.Host during create (clusterctl move scenario)",
634634
amcp: &AzureManagedControlPlane{
635635
Spec: AzureManagedControlPlaneSpec{
636636
ControlPlaneEndpoint: clusterv1.APIEndpoint{
@@ -647,10 +647,10 @@ func TestAzureManagedControlPlane_ValidateCreate(t *testing.T) {
647647
},
648648
},
649649
},
650-
wantErr: true,
650+
wantErr: false,
651651
},
652652
{
653-
name: "can't set Spec.ControlPlaneEndpoint.Port during create",
653+
name: "can set Spec.ControlPlaneEndpoint.Port during create (clusterctl move scenario)",
654654
amcp: &AzureManagedControlPlane{
655655
Spec: AzureManagedControlPlaneSpec{
656656
ControlPlaneEndpoint: clusterv1.APIEndpoint{
@@ -667,7 +667,7 @@ func TestAzureManagedControlPlane_ValidateCreate(t *testing.T) {
667667
},
668668
},
669669
},
670-
wantErr: true,
670+
wantErr: false,
671671
},
672672
}
673673
for _, tc := range tests {
@@ -1224,81 +1224,6 @@ func TestAzureManagedControlPlane_ValidateUpdate(t *testing.T) {
12241224
},
12251225
wantErr: false,
12261226
},
1227-
{
1228-
name: "AzureManagedControlPlane ControlPlaneEndpoint.Port is immutable",
1229-
oldAMCP: &AzureManagedControlPlane{
1230-
ObjectMeta: metav1.ObjectMeta{
1231-
Name: "test-cluster",
1232-
},
1233-
Spec: AzureManagedControlPlaneSpec{
1234-
ControlPlaneEndpoint: clusterv1.APIEndpoint{
1235-
Host: "aks-8622-h4h26c44.hcp.eastus.azmk8s.io",
1236-
Port: 443,
1237-
},
1238-
},
1239-
},
1240-
amcp: &AzureManagedControlPlane{
1241-
ObjectMeta: metav1.ObjectMeta{
1242-
Name: "test-cluster",
1243-
},
1244-
Spec: AzureManagedControlPlaneSpec{
1245-
ControlPlaneEndpoint: clusterv1.APIEndpoint{
1246-
Host: "aks-8622-h4h26c44.hcp.eastus.azmk8s.io",
1247-
Port: 444,
1248-
},
1249-
},
1250-
},
1251-
wantErr: true,
1252-
},
1253-
{
1254-
name: "AzureManagedControlPlane ControlPlaneEndpoint.Host is immutable",
1255-
oldAMCP: &AzureManagedControlPlane{
1256-
ObjectMeta: metav1.ObjectMeta{
1257-
Name: "test-cluster",
1258-
},
1259-
Spec: AzureManagedControlPlaneSpec{
1260-
ControlPlaneEndpoint: clusterv1.APIEndpoint{
1261-
Host: "aks-8622-h4h26c44.hcp.eastus.azmk8s.io",
1262-
Port: 443,
1263-
},
1264-
},
1265-
},
1266-
amcp: &AzureManagedControlPlane{
1267-
ObjectMeta: metav1.ObjectMeta{
1268-
Name: "test-cluster",
1269-
},
1270-
Spec: AzureManagedControlPlaneSpec{
1271-
ControlPlaneEndpoint: clusterv1.APIEndpoint{
1272-
Host: "this-is-not-allowed",
1273-
Port: 443,
1274-
},
1275-
},
1276-
},
1277-
wantErr: true,
1278-
},
1279-
{
1280-
name: "ControlPlaneEndpoint update from zero values are allowed",
1281-
oldAMCP: &AzureManagedControlPlane{
1282-
ObjectMeta: metav1.ObjectMeta{
1283-
Name: "test-cluster",
1284-
},
1285-
Spec: AzureManagedControlPlaneSpec{
1286-
ControlPlaneEndpoint: clusterv1.APIEndpoint{},
1287-
},
1288-
},
1289-
amcp: &AzureManagedControlPlane{
1290-
ObjectMeta: metav1.ObjectMeta{
1291-
Name: "test-cluster",
1292-
},
1293-
Spec: AzureManagedControlPlaneSpec{
1294-
ControlPlaneEndpoint: clusterv1.APIEndpoint{
1295-
Host: "aks-8622-h4h26c44.hcp.eastus.azmk8s.io",
1296-
Port: 443,
1297-
},
1298-
},
1299-
},
1300-
wantErr: true,
1301-
},
13021227
{
13031228
name: "OutboundType update",
13041229
oldAMCP: &AzureManagedControlPlane{

‎azure/scope/managedcontrolplane.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -578,12 +578,8 @@ func (s *ManagedControlPlaneScope) GetAllAgentPoolSpecs() ([]azure.ResourceSpecG
578578

579579
// SetControlPlaneEndpoint sets a control plane endpoint.
580580
func (s *ManagedControlPlaneScope) SetControlPlaneEndpoint(endpoint clusterv1.APIEndpoint) {
581-
if s.ControlPlane.Spec.ControlPlaneEndpoint.Host == "" {
582-
s.ControlPlane.Spec.ControlPlaneEndpoint.Host = endpoint.Host
583-
}
584-
if s.ControlPlane.Spec.ControlPlaneEndpoint.Port == 0 {
585-
s.ControlPlane.Spec.ControlPlaneEndpoint.Port = endpoint.Port
586-
}
581+
s.ControlPlane.Spec.ControlPlaneEndpoint.Host = endpoint.Host
582+
s.ControlPlane.Spec.ControlPlaneEndpoint.Port = endpoint.Port
587583
}
588584

589585
// MakeEmptyKubeConfigSecret creates an empty secret object that is used for storing kubeconfig secret data.

‎controllers/azuremanagedcluster_controller.go‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -161,14 +161,7 @@ func (amcr *AzureManagedClusterReconciler) Reconcile(ctx context.Context, req ct
161161
// Infrastructure must be ready before control plane. We should also enqueue
162162
// requests from control plane to infra cluster to keep control plane endpoint accurate.
163163
aksCluster.Status.Ready = true
164-
// We only expect to set the apiserver endpoint values once;
165-
// if we attempted to update existing ControlPlaneEndpoint values, they would be rejected via webhook enforcement.
166-
if aksCluster.Spec.ControlPlaneEndpoint.Host == "" {
167-
aksCluster.Spec.ControlPlaneEndpoint.Host = controlPlane.Spec.ControlPlaneEndpoint.Host
168-
}
169-
if aksCluster.Spec.ControlPlaneEndpoint.Port == 0 {
170-
aksCluster.Spec.ControlPlaneEndpoint.Port = controlPlane.Spec.ControlPlaneEndpoint.Port
171-
}
164+
aksCluster.Spec.ControlPlaneEndpoint = controlPlane.Spec.ControlPlaneEndpoint
172165

173166
if err := patchhelper.Patch(ctx, aksCluster); err != nil {
174167
return reconcile.Result{}, err

‎docs/book/src/topics/managedcluster.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,8 @@ spec:
194194
sku: Standard_D2s_v4
195195
```
196196
197+
Please note that we don't declare a configuration for the apiserver endpoint. This configuration data will be populated automatically based on the data returned from AKS API during cluster create as `.spec.controlPlaneEndpoint.Host` and `.spec.controlPlaneEndpoint.Port` in both the `AzureManagedCluster` and `AzureManagedControlPlane` resources. Any user-provided data will be ignored and overwritten by data returned from the AKS API.
198+
197199
The main features for configuration are:
198200

199201
- [networkPolicy](https://docs.microsoft.com/en-us/azure/aks/concepts-network#network-policies)
@@ -717,7 +719,8 @@ Following is the list of immutable fields for managed clusters:
717719

718720
| CRD | jsonPath | Comment |
719721
|---------------------------|------------------------------|---------------------------|
720-
| AzureManagedControlPlane | .name | |
722+
| AzureManagedCluster | .spec.controlPlaneEndpoint | populated by the AKS API during cluster create |
723+
| AzureManagedControlPlane | .spec.controlPlaneEndpoint | populated by the AKS API during cluster create |
721724
| AzureManagedControlPlane | .spec.subscriptionID | |
722725
| AzureManagedControlPlane | .spec.resourceGroupName | |
723726
| AzureManagedControlPlane | .spec.nodeResourceGroupName | |

0 commit comments

Comments
 (0)