Merge pull request #11969 from chrischdi/pr-cluster-validate-update-refs

🌱 cluster: validate that infrastructureRef and controlPlaneRef cannot be unset

Author: k8s-ci-robot

internal/webhooks/cluster.go

@@ -209,7 +209,17 @@ func (webhook *Cluster) validate(ctx context.Context, oldCluster, newCluster *cl
 			)
 		}
 	}
+
 	specPath := field.NewPath("spec")
+	if newCluster.Spec.InfrastructureRef == nil && oldCluster != nil && oldCluster.Spec.InfrastructureRef != nil {
+		allErrs = append(
+			allErrs,
+			field.Forbidden(
+				specPath.Child("infrastructureRef"),
+				"cannot be removed",
+			),
+		)
+	}
 	if newCluster.Spec.InfrastructureRef != nil && newCluster.Spec.InfrastructureRef.Namespace != newCluster.Namespace {
 		allErrs = append(
 			allErrs,
@@ -221,6 +231,15 @@ func (webhook *Cluster) validate(ctx context.Context, oldCluster, newCluster *cl
 		)
 	}
 
+	if newCluster.Spec.ControlPlaneRef == nil && oldCluster != nil && oldCluster.Spec.ControlPlaneRef != nil {
+		allErrs = append(
+			allErrs,
+			field.Forbidden(
+				specPath.Child("controlPlaneRef"),
+				"cannot be removed",
+			),
+		)
+	}
 	if newCluster.Spec.ControlPlaneRef != nil && newCluster.Spec.ControlPlaneRef.Namespace != newCluster.Namespace {
 		allErrs = append(
 			allErrs,

internal/webhooks/cluster_test.go

@@ -1613,6 +1613,26 @@ func TestClusterValidation(t *testing.T) {
 			in:        builder.Cluster("fooNamespace", "thisNameContainsInvalid!@NonAlphanumerics").Build(),
 			expectErr: true,
 		},
+		{
+			name: "error when controlPlaneRef gets unset",
+			in: builder.Cluster("fooNamespace", "cluster1").
+				Build(),
+			old: builder.Cluster("fooNamespace", "cluster1").
+				WithControlPlane(
+					builder.ControlPlane("fooNamespace", "cp1").Build()).
+				Build(),
+			expectErr: true,
+		},
+		{
+			name: "error when infrastructureRef gets unset",
+			in: builder.Cluster("fooNamespace", "cluster1").
+				Build(),
+			old: builder.Cluster("fooNamespace", "cluster1").
+				WithInfrastructureCluster(
+					builder.InfrastructureClusterTemplate("fooNamespace", "infra1").Build()).
+				Build(),
+			expectErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {