Skip to content

Commit a538d6c

Browse files
grzpiotrowskigrzpiotrowski
committed
Add IngressController .spec.domain API validation
This commit fixes OCPBUGS-55192. https://issues.redhat.com/browse/OCPBUGS-55192 Add ratcheting validation of the .spec.domain field of ingress controller. Domain must consist of lowercase alphanumeric characters '-' or '.', and each label must start and end with an alphanumeric character. * operator/v1/types_ingress.go (IngressControllerSpec): Add ratcheting validation of the Domain field. * operator/v1/tests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml Add test cases for the ingress controller .spec.domain field validation
1 parent fb1b1c7 commit a538d6c

File tree

4 files changed

+101
-4
lines changed

4 files changed

+101
-4
lines changed

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 2 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29269,7 +29269,6 @@
2926929269
"$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference"
2927029270
},
2927129271
"domain": {
29272-
"description": "domain is a DNS name serviced by the ingress controller and is used to configure multiple features:\n\n* For the LoadBalancerService endpoint publishing strategy, domain is\n used to configure DNS records. See endpointPublishingStrategy.\n\n* When using a generated default certificate, the certificate will be valid\n for domain and its subdomains. See defaultCertificate.\n\n* The value is published to individual Route statuses so that end-users\n know where to target external DNS records.\n\ndomain must be unique among all IngressControllers, and cannot be updated.\n\nIf empty, defaults to ingress.config.openshift.io/cluster .spec.domain.",
2927329272
"type": "string"
2927429273
},
2927529274
"endpointPublishingStrategy": {

‎operator/v1/tests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -565,3 +565,99 @@ tests:
565565
tuningOptions:
566566
connectTimeout: "4 s"
567567
expectedError: "IngressController.operator.openshift.io \"default\" is invalid: spec.tuningOptions.connectTimeout: Invalid value: \"4 s\": spec.tuningOptions.connectTimeout in body should match '^(0|([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$'"
568+
- name: Should be able to create an IngressController with valid domain
569+
initial: |
570+
apiVersion: operator.openshift.io/v1
571+
kind: IngressController
572+
metadata:
573+
name: ic-spec-domain-test
574+
namespace: openshift-ingress-operator
575+
spec:
576+
domain: "foo.com"
577+
expected: |
578+
apiVersion: operator.openshift.io/v1
579+
kind: IngressController
580+
metadata:
581+
name: ic-spec-domain-test
582+
namespace: openshift-ingress-operator
583+
spec:
584+
domain: "foo.com"
585+
- name: Should not be able to create an IngressController with invalid domain
586+
initial: |
587+
apiVersion: operator.openshift.io/v1
588+
kind: IngressController
589+
metadata:
590+
name: ic-spec-domain-test
591+
namespace: openshift-ingress-operator
592+
spec:
593+
domain: "*.foo.com"
594+
expectedError: "domain must consist of lowercase alphanumeric characters, '-' or '.', and each label must start and end with an alphanumeric character"
595+
onUpdate:
596+
- name: Should be able to update invalid domain to a valid domain
597+
initial: |
598+
apiVersion: operator.openshift.io/v1
599+
kind: IngressController
600+
metadata:
601+
name: ic-spec-domain-test
602+
namespace: openshift-ingress-operator
603+
spec:
604+
domain: "*.foo.com"
605+
updated: |
606+
apiVersion: operator.openshift.io/v1
607+
kind: IngressController
608+
metadata:
609+
name: ic-spec-domain-test
610+
namespace: openshift-ingress-operator
611+
spec:
612+
domain: "123-foo.com"
613+
expected: |
614+
apiVersion: operator.openshift.io/v1
615+
kind: IngressController
616+
metadata:
617+
name: ic-spec-domain-test
618+
namespace: openshift-ingress-operator
619+
spec:
620+
domain: "123-foo.com"
621+
- name: Should be able to retain already invalid domain when it is not modified on update
622+
initial: |
623+
apiVersion: operator.openshift.io/v1
624+
kind: IngressController
625+
metadata:
626+
name: ic-spec-domain-test
627+
namespace: openshift-ingress-operator
628+
spec:
629+
domain: "*.foo.com"
630+
updated: |
631+
apiVersion: operator.openshift.io/v1
632+
kind: IngressController
633+
metadata:
634+
name: ic-spec-domain-test
635+
namespace: openshift-ingress-operator
636+
spec:
637+
domain: "*.foo.com"
638+
expected: |
639+
apiVersion: operator.openshift.io/v1
640+
kind: IngressController
641+
metadata:
642+
name: ic-spec-domain-test
643+
namespace: openshift-ingress-operator
644+
spec:
645+
domain: "*.foo.com"
646+
- name: Should not be able to update already invalid domain to another invalid domain
647+
initial: |
648+
apiVersion: operator.openshift.io/v1
649+
kind: IngressController
650+
metadata:
651+
name: ic-spec-domain-test
652+
namespace: openshift-ingress-operator
653+
spec:
654+
domain: "*.foo.com"
655+
updated: |
656+
apiVersion: operator.openshift.io/v1
657+
kind: IngressController
658+
metadata:
659+
name: ic-spec-domain-test
660+
namespace: openshift-ingress-operator
661+
spec:
662+
domain: "foo.*.com"
663+
expectedError: "domain must consist of lowercase alphanumeric characters, '-' or '.', and each label must start and end with an alphanumeric character"

‎operator/v1/types_ingress.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,9 @@ type IngressControllerSpec struct {
6969
// If empty, defaults to ingress.config.openshift.io/cluster .spec.domain.
7070
//
7171
// +optional
72+
// +kubebuilder:validation:XValidation:rule="(has(oldSelf) && self == oldSelf) || self.matches('^([a-z0-9]+|[a-z0-9]+[a-z0-9\\-]*[a-z0-9]+)(\\.([a-z0-9]+|[a-z0-9]+[a-z0-9\\-]*[a-z0-9]+))*$')"
73+
// message="domain must consist of lowercase alphanumeric characters, '-' or '.', and each label must start and end with an alphanumeric character"
74+
7275
Domain string `json:"domain,omitempty"`
7376

7477
// httpErrorCodePages specifies a configmap with custom error pages.

0 commit comments

Comments
 (0)