diff --git a/pkg/webhook/validate.go b/pkg/webhook/validate.go index 971d147cde..d8f336b188 100644 --- a/pkg/webhook/validate.go +++ b/pkg/webhook/validate.go @@ -269,7 +269,24 @@ func validatePolicyForNodePolicy( } } } - return true, nil + + return validateExludeTopologyField(current, previous) +} + +func validateExludeTopologyField( + current *sriovnetworkv1.SriovNetworkNodePolicy, + previous *sriovnetworkv1.SriovNetworkNodePolicy, +) (bool, error) { + if current.Spec.ResourceName != previous.Spec.ResourceName { + return true, nil + } + + if current.Spec.ExcludeTopology == previous.Spec.ExcludeTopology { + return true, nil + } + + return false, fmt.Errorf("excludeTopology[%t] field conflicts with policy [%s].ExcludeTopology[%t] as they target the same resource[%s]", + current.Spec.ExcludeTopology, previous.GetName(), previous.Spec.ExcludeTopology, current.Spec.ResourceName) } func validateNicModel(selector *sriovnetworkv1.SriovNetworkNicSelector, iface *sriovnetworkv1.InterfaceExt, node *corev1.Node) bool { diff --git a/pkg/webhook/validate_test.go b/pkg/webhook/validate_test.go index 906d5e85a6..dd0b937082 100644 --- a/pkg/webhook/validate_test.go +++ b/pkg/webhook/validate_test.go @@ -298,6 +298,54 @@ func TestValidatePolicyForNodeStateWithUpdatedExistingVfRange(t *testing.T) { g.Expect(ok).To(Equal(true)) } +func TestValidatePoliciesWithDifferentExcludeTopologyForTheSameResource(t *testing.T) { + current := &SriovNetworkNodePolicy{ + ObjectMeta: metav1.ObjectMeta{Name: "currentPolicy"}, + Spec: SriovNetworkNodePolicySpec{ + ResourceName: "resourceX", + ExcludeTopology: true, + }, + } + + previous := &SriovNetworkNodePolicy{ + ObjectMeta: metav1.ObjectMeta{Name: "previousPolicy"}, + Spec: SriovNetworkNodePolicySpec{ + ResourceName: "resourceX", + ExcludeTopology: false, + }, + } + + ok, err := validatePolicyForNodePolicy(current, previous) + + g := NewGomegaWithT(t) + g.Expect(ok).To(Equal(false)) + g.Expect(err).To(MatchError("ExcludeTopology[true] field conflicts with policy [previousPolicy].ExcludeTopology[false] as they target the same resource[resourceX]")) +} + +func TestValidatePoliciesWithSameExcludeTopologyForTheSameResource(t *testing.T) { + current := &SriovNetworkNodePolicy{ + ObjectMeta: metav1.ObjectMeta{Name: "currentPolicy"}, + Spec: SriovNetworkNodePolicySpec{ + ResourceName: "resourceX", + ExcludeTopology: true, + }, + } + + previous := &SriovNetworkNodePolicy{ + ObjectMeta: metav1.ObjectMeta{Name: "previousPolicy"}, + Spec: SriovNetworkNodePolicySpec{ + ResourceName: "resourceX", + ExcludeTopology: true, + }, + } + + ok, err := validatePolicyForNodePolicy(current, previous) + + g := NewGomegaWithT(t) + g.Expect(ok).To(Equal(true)) + g.Expect(err).NotTo(HaveOccurred()) +} + func TestStaticValidateSriovNetworkNodePolicyWithValidVendorDevice(t *testing.T) { policy := &SriovNetworkNodePolicy{ Spec: SriovNetworkNodePolicySpec{