CLOUDP-303356: Make container id or name immutable (#2165)

Signed-off-by: jose.vazquez <[email protected]>

Author: josvazg

api/v1/atlasnetworkpeering_types.go

@@ -58,6 +58,8 @@ type AtlasNetworkPeeringList struct {
 // +kubebuilder:validation:XValidation:rule="(has(self.externalProjectRef) && !has(self.projectRef)) || (!has(self.externalProjectRef) && has(self.projectRef))",message="must define only one project reference through externalProjectRef or projectRef"
 // +kubebuilder:validation:XValidation:rule="(has(self.externalProjectRef) && has(self.connectionSecret)) || !has(self.externalProjectRef)",message="must define a local connection secret when referencing an external project"
 // +kubebuilder:validation:XValidation:rule="(has(self.containerRef.name) && !has(self.containerRef.id)) || (!has(self.containerRef.name) && has(self.containerRef.id))",message="must either have a container Atlas id or Kubernetes name, but not both (or neither)"
+// +kubebuilder:validation:XValidation:rule="(self.containerRef.name == oldSelf.containerRef.name) || (!has(self.containerRef.name) && !has(oldSelf.containerRef.name))",message="container ref name is immutable"
+// +kubebuilder:validation:XValidation:rule="(self.containerRef.id == oldSelf.containerRef.id) || (!has(self.containerRef.id) && !has(oldSelf.containerRef.id))",message="container ref id is immutable"
 // +kubebuilder:validation:XValidation:rule="(self.id == oldSelf.id) || (!has(self.id) && !has(oldSelf.id))",message="id is immutable"
 type AtlasNetworkPeeringSpec struct {
 	ProjectDualReference `json:",inline"`

api/v1/atlasnetworkpeering_types_test.go

@@ -124,7 +124,7 @@ func TestPeeringCELChecks(t *testing.T) {
 			old: &AtlasNetworkPeering{
 				Spec: AtlasNetworkPeeringSpec{
 					ContainerRef: ContainerDualReference{
-						ID: "some-id",
+						Name: "some-name",
 					},
 					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
 						ID: "some-peering-id",
@@ -134,7 +134,7 @@ func TestPeeringCELChecks(t *testing.T) {
 			obj: &AtlasNetworkPeering{
 				Spec: AtlasNetworkPeeringSpec{
 					ContainerRef: ContainerDualReference{
-						ID: "some-id",
+						Name: "some-name",
 					},
 					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
 						ID: "another-peering-id",
@@ -167,6 +167,112 @@ func TestPeeringCELChecks(t *testing.T) {
 				},
 			},
 		},
+
+		{
+			title: "container ID changed fails",
+			old: &AtlasNetworkPeering{
+				Spec: AtlasNetworkPeeringSpec{
+					ContainerRef: ContainerDualReference{
+						ID: "some-id",
+					},
+					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
+						ID: "some-peering-id",
+					},
+				},
+			},
+			obj: &AtlasNetworkPeering{
+				Spec: AtlasNetworkPeeringSpec{
+					ContainerRef: ContainerDualReference{
+						ID: "some-other-id",
+					},
+					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
+						ID: "some-peering-id",
+					},
+				},
+			},
+			expectedErrors: []string{"spec: Invalid value: \"object\": container ref id is immutable"},
+		},
+
+		{
+			title: "container name changed fails",
+			old: &AtlasNetworkPeering{
+				Spec: AtlasNetworkPeeringSpec{
+					ContainerRef: ContainerDualReference{
+						Name: "some-name",
+					},
+					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
+						ID: "some-peering-id",
+					},
+				},
+			},
+			obj: &AtlasNetworkPeering{
+				Spec: AtlasNetworkPeeringSpec{
+					ContainerRef: ContainerDualReference{
+						Name: "some-other-name",
+					},
+					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
+						ID: "some-peering-id",
+					},
+				},
+			},
+			expectedErrors: []string{"spec: Invalid value: \"object\": container ref name is immutable"},
+		},
+
+		{
+			title: "change container name to id fails",
+			old: &AtlasNetworkPeering{
+				Spec: AtlasNetworkPeeringSpec{
+					ContainerRef: ContainerDualReference{
+						Name: "some-name",
+					},
+					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
+						ID: "some-peering-id",
+					},
+				},
+			},
+			obj: &AtlasNetworkPeering{
+				Spec: AtlasNetworkPeeringSpec{
+					ContainerRef: ContainerDualReference{
+						ID: "some-id",
+					},
+					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
+						ID: "some-peering-id",
+					},
+				},
+			},
+			expectedErrors: []string{
+				"spec: Invalid value: \"object\": no such key: name evaluating rule: container ref name is immutable",
+				"spec: Invalid value: \"object\": no such key: id evaluating rule: container ref id is immutable",
+			},
+		},
+
+		{
+			title: "change container id to name fails",
+			old: &AtlasNetworkPeering{
+				Spec: AtlasNetworkPeeringSpec{
+					ContainerRef: ContainerDualReference{
+						ID: "some-id",
+					},
+					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
+						ID: "some-peering-id",
+					},
+				},
+			},
+			obj: &AtlasNetworkPeering{
+				Spec: AtlasNetworkPeeringSpec{
+					ContainerRef: ContainerDualReference{
+						Name: "some-name",
+					},
+					AtlasNetworkPeeringConfig: AtlasNetworkPeeringConfig{
+						ID: "some-peering-id",
+					},
+				},
+			},
+			expectedErrors: []string{
+				"spec: Invalid value: \"object\": no such key: name evaluating rule: container ref name is immutable",
+				"spec: Invalid value: \"object\": no such key: id evaluating rule: container ref id is immutable",
+			},
+		},
 	} {
 		t.Run(tc.title, func(t *testing.T) {
 			// inject a project to avoid other CEL validations being hit

config/crd/bases/atlas.mongodb.com_atlasnetworkpeerings.yaml

@@ -202,6 +202,12 @@ spec:
                 not both (or neither)
               rule: (has(self.containerRef.name) && !has(self.containerRef.id)) ||
                 (!has(self.containerRef.name) && has(self.containerRef.id))
+            - message: container ref name is immutable
+              rule: (self.containerRef.name == oldSelf.containerRef.name) || (!has(self.containerRef.name)
+                && !has(oldSelf.containerRef.name))
+            - message: container ref id is immutable
+              rule: (self.containerRef.id == oldSelf.containerRef.id) || (!has(self.containerRef.id)
+                && !has(oldSelf.containerRef.id))
             - message: id is immutable
               rule: (self.id == oldSelf.id) || (!has(self.id) && !has(oldSelf.id))
           status: