Skip to content

OCPBUGS-32275: Add ingress.spec.domain immutability validation #2695

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
grzpiotrowski wants to merge 1 commit into
base: master
Choose a base branch
from
Open

OCPBUGS-32275: Add ingress.spec.domain immutability validation #2695

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions config/v1/tests/ingresses.config.openshift.io/AAA_ungated.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,45 @@ tests:
apiVersion: config.openshift.io/v1
kind: Ingress
spec: {}
- name: Should be able to create an Ingress with domain set
initial: |
apiVersion: config.openshift.io/v1
kind: Ingress
spec:
domain: apps.example.com
expected: |
apiVersion: config.openshift.io/v1
kind: Ingress
spec:
domain: apps.example.com
onUpdate:
- name: Should not be able to change domain once set
initial: |
apiVersion: config.openshift.io/v1
kind: Ingress
spec:
domain: apps.example.com
updated: |
apiVersion: config.openshift.io/v1
kind: Ingress
spec:
domain: test.example.com
expectedError: "domain is immutable once set"
- name: Should be able to update other fields without changing domain
initial: |
apiVersion: config.openshift.io/v1
kind: Ingress
spec:
domain: apps.example.com
updated: |
apiVersion: config.openshift.io/v1
kind: Ingress
spec:
domain: apps.example.com
appsDomain: custom.example.com
expected: |
apiVersion: config.openshift.io/v1
kind: Ingress
spec:
domain: apps.example.com
appsDomain: custom.example.com
1 change: 1 addition & 0 deletions config/v1/types_ingress.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ type IngressSpec struct {
// default ingresscontroller domain will follow this pattern: "*.<domain>".
//
// Once set, changing domain is not currently supported.
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="domain is immutable once set"
Domain string `json:"domain"`
Comment on lines +46 to 47
Copy link
Contributor

@everettraven everettraven Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as a comment from another thread, but copying here for posterity: Do we want to make "" unable to be changed here? What happens today if this field is set to ""?


// appsDomain is an optional domain to use instead of the one specified
Expand Down
3 changes: 3 additions & 0 deletions config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,9 @@ spec:

Once set, changing domain is not currently supported.
type: string
x-kubernetes-validations:
- message: domain is immutable once set
rule: self == oldSelf
loadBalancer:
description: |-
loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
Expand Down
3 changes: 3 additions & 0 deletions ...v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/AAA_ungated.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,9 @@ spec:
Once set, changing domain is not currently supported.
type: string
x-kubernetes-validations:
- message: domain is immutable once set
rule: self == oldSelf
loadBalancer:
description: |-
loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
Expand Down
3 changes: 3 additions & 0 deletions payload-manifests/crds/0000_10_config-operator_01_ingresses.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,9 @@ spec:

Once set, changing domain is not currently supported.
type: string
x-kubernetes-validations:
- message: domain is immutable once set
rule: self == oldSelf
Comment on lines +132 to +134
Copy link

@Thealisyed Thealisyed Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So the rule is self == OldSelf is immutable but what happens if the domain filed was never empty on an existing cluster? Does that cause a breaking change then?

Copy link
Contributor

@everettraven everettraven Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These validations should ratchet.

If the domain field was specified as a non-empty string on an existing cluster, this would take effect and make it so that updates cannot change the field.

Based on the bug this is linked to, that was never supported and causes degradation in the cluster, which means it should generally be OK to tighten this.

Where this would be interesting is if "" is a valid value for this field - which it looks like it might be from an admission standpoint and is something I missed. @grzpiotrowski what happens if the field this validation was added to is set to ""? Should that be able to be modified to set it to a non-empty string?

loadBalancer:
description: |-
loadBalancer contains the load balancer details in general which are not only specific to the underlying infrastructure
Expand Down