From ef6eea62dca5db84c6a729cf5c26e3accb33b1fa Mon Sep 17 00:00:00 2001 From: Maksim Fedotov Date: Thu, 27 May 2021 18:23:36 +0300 Subject: [PATCH] fix: wrong order of checks in validating-external-service-ips webhook --- pkg/webhook/services/validating.go | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/pkg/webhook/services/validating.go b/pkg/webhook/services/validating.go index 9d40349d..a70b00c2 100644 --- a/pkg/webhook/services/validating.go +++ b/pkg/webhook/services/validating.go @@ -68,10 +68,6 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder return admission.Errored(http.StatusBadRequest, err) } - if svc.Spec.ExternalIPs == nil { - return admission.Allowed("") - } - tntList := &v1alpha1.TenantList{} if err := clt.List(ctx, tntList, client.MatchingFieldsSelector{ Selector: fields.OneTermEqualSelector(".status.namespaces", svc.GetNamespace()), @@ -83,7 +79,11 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder } tnt := tntList.Items[0] - if tnt.Spec.ExternalServiceIPs == nil { + if svc.Spec.Type == corev1.ServiceTypeNodePort && tnt.GetAnnotations()[enableNodePortsAnnotation] == "false" { + return admission.Errored(http.StatusBadRequest, NewNodePortDisabledError()) + } + + if svc.Spec.ExternalIPs == nil || tnt.Spec.ExternalServiceIPs == nil { return admission.Allowed("") } @@ -97,10 +97,6 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder } } - if svc.Spec.Type == corev1.ServiceTypeNodePort && tnt.GetAnnotations()[enableNodePortsAnnotation] == "false" { - return admission.Errored(http.StatusBadRequest, NewNodePortDisabledError()) - } - return admission.Errored(http.StatusBadRequest, NewExternalServiceIPForbidden(tnt.Spec.ExternalServiceIPs.Allowed)) }