diff --git a/pkg/api/error.go b/pkg/api/error.go index 6d007fc6dd4..8e688331c42 100644 --- a/pkg/api/error.go +++ b/pkg/api/error.go @@ -104,6 +104,7 @@ const ( CloudErrorCodeRequestDisallowedByPolicy = "RequestDisallowedByPolicy" CloudErrorCodeInvalidNetworkAddress = "InvalidNetworkAddress" CloudErrorCodeThrottlingLimitExceeded = "ThrottlingLimitExceeded" + CloudErrorCodeInvalidCIDRRange = "InvalidCIDRRange" ) // NewCloudError returns a new CloudError diff --git a/pkg/api/openshiftcluster.go b/pkg/api/openshiftcluster.go index 0826520d0bb..90df0931a39 100644 --- a/pkg/api/openshiftcluster.go +++ b/pkg/api/openshiftcluster.go @@ -367,6 +367,15 @@ type NetworkProfile struct { LoadBalancerProfile *LoadBalancerProfile `json:"loadBalancerProfile,omitempty"` } +// IP address ranges internally used by ARO +var ( + JoinCIDRRange []string = []string{ + "100.64.0.0/16", + "169.254.169.0/29", + "100.88.0.0/16", + } +) + // PreconfiguredNSG represents whether customers want to use their own NSG attached to the subnets type PreconfiguredNSG string diff --git a/pkg/api/v20191231preview/openshiftcluster_validatestatic.go b/pkg/api/v20191231preview/openshiftcluster_validatestatic.go index 8e34729ed57..24fadfe3a3a 100644 --- a/pkg/api/v20191231preview/openshiftcluster_validatestatic.go +++ b/pkg/api/v20191231preview/openshiftcluster_validatestatic.go @@ -189,7 +189,6 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile) error { podIP, pod, err := net.ParseCIDR(np.PodCIDR) - if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } @@ -198,6 +197,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) + } + } + ones, _ := pod.Mask.Size() if ones > 18 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) @@ -218,6 +224,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) + } + } + ones, _ = service.Mask.Size() if ones > 22 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) diff --git a/pkg/api/v20191231preview/openshiftcluster_validatestatic_test.go b/pkg/api/v20191231preview/openshiftcluster_validatestatic_test.go index 4bac8bc1dce..6b942196230 100644 --- a/pkg/api/v20191231preview/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20191231preview/openshiftcluster_validatestatic_test.go @@ -461,6 +461,48 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, tests) diff --git a/pkg/api/v20200430/openshiftcluster_validatestatic.go b/pkg/api/v20200430/openshiftcluster_validatestatic.go index 6b056f8b8f0..bf057d6fbcb 100644 --- a/pkg/api/v20200430/openshiftcluster_validatestatic.go +++ b/pkg/api/v20200430/openshiftcluster_validatestatic.go @@ -192,11 +192,17 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile) error { podIP, pod, err := net.ParseCIDR(np.PodCIDR) - if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) + } + } + if pod.IP.To4() == nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } @@ -217,6 +223,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: '%s'.", np.ServiceCIDR, err) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) + } + } + if service.IP.To4() == nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } diff --git a/pkg/api/v20200430/openshiftcluster_validatestatic_test.go b/pkg/api/v20200430/openshiftcluster_validatestatic_test.go index a483dadd83b..af2b2a638ce 100644 --- a/pkg/api/v20200430/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20200430/openshiftcluster_validatestatic_test.go @@ -461,6 +461,48 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, tests) diff --git a/pkg/api/v20210901preview/openshiftcluster_validatestatic.go b/pkg/api/v20210901preview/openshiftcluster_validatestatic.go index 16527c82c46..fe3c4714350 100644 --- a/pkg/api/v20210901preview/openshiftcluster_validatestatic.go +++ b/pkg/api/v20210901preview/openshiftcluster_validatestatic.go @@ -192,7 +192,6 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile) error { podIP, pod, err := net.ParseCIDR(np.PodCIDR) - if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } @@ -201,6 +200,16 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } + switch np.SoftwareDefinedNetwork { + case SoftwareDefinedNetworkOVNKubernetes: + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) + } + } + } + ones, _ := pod.Mask.Size() if ones > 18 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) @@ -221,6 +230,16 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } + switch np.SoftwareDefinedNetwork { + case SoftwareDefinedNetworkOVNKubernetes: + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) + } + } + } + ones, _ = service.Mask.Size() if ones > 22 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) diff --git a/pkg/api/v20210901preview/openshiftcluster_validatestatic_test.go b/pkg/api/v20210901preview/openshiftcluster_validatestatic_test.go index b423c48b608..6b76d016d86 100644 --- a/pkg/api/v20210901preview/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20210901preview/openshiftcluster_validatestatic_test.go @@ -501,6 +501,48 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, commontests) diff --git a/pkg/api/v20220401/openshiftcluster_validatestatic.go b/pkg/api/v20220401/openshiftcluster_validatestatic.go index 7c63e28c210..dc2cbd7d58b 100644 --- a/pkg/api/v20220401/openshiftcluster_validatestatic.go +++ b/pkg/api/v20220401/openshiftcluster_validatestatic.go @@ -198,7 +198,6 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile) error { podIP, pod, err := net.ParseCIDR(np.PodCIDR) - if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } @@ -207,6 +206,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) + } + } + ones, _ := pod.Mask.Size() if ones > 18 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) @@ -227,6 +233,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) + } + } + ones, _ = service.Mask.Size() if ones > 22 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) diff --git a/pkg/api/v20220401/openshiftcluster_validatestatic_test.go b/pkg/api/v20220401/openshiftcluster_validatestatic_test.go index ef0e6075d91..9020a7153ae 100644 --- a/pkg/api/v20220401/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20220401/openshiftcluster_validatestatic_test.go @@ -492,6 +492,48 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, tests) diff --git a/pkg/api/v20220904/openshiftcluster_validatestatic.go b/pkg/api/v20220904/openshiftcluster_validatestatic.go index 7888c0a4ce0..7bd48b02409 100644 --- a/pkg/api/v20220904/openshiftcluster_validatestatic.go +++ b/pkg/api/v20220904/openshiftcluster_validatestatic.go @@ -198,7 +198,6 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile) error { podIP, pod, err := net.ParseCIDR(np.PodCIDR) - if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } @@ -207,6 +206,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) + } + } + ones, _ := pod.Mask.Size() if ones > 18 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) @@ -227,6 +233,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) + } + } + ones, _ = service.Mask.Size() if ones > 22 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) diff --git a/pkg/api/v20220904/openshiftcluster_validatestatic_test.go b/pkg/api/v20220904/openshiftcluster_validatestatic_test.go index 6f882697aec..e38932f4c07 100644 --- a/pkg/api/v20220904/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20220904/openshiftcluster_validatestatic_test.go @@ -507,6 +507,48 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, tests) diff --git a/pkg/api/v20230401/openshiftcluster_validatestatic.go b/pkg/api/v20230401/openshiftcluster_validatestatic.go index 155ec15265c..38b9bdec7b1 100644 --- a/pkg/api/v20230401/openshiftcluster_validatestatic.go +++ b/pkg/api/v20230401/openshiftcluster_validatestatic.go @@ -198,7 +198,6 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile, apiServerVisibility Visibility, ingressVisibility Visibility) error { podIP, pod, err := net.ParseCIDR(np.PodCIDR) - if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } @@ -207,6 +206,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) + } + } + ones, _ := pod.Mask.Size() if ones > 18 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) @@ -227,6 +233,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) + } + } + ones, _ = service.Mask.Size() if ones > 22 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) diff --git a/pkg/api/v20230401/openshiftcluster_validatestatic_test.go b/pkg/api/v20230401/openshiftcluster_validatestatic_test.go index 252f18637a1..cb17af523f0 100644 --- a/pkg/api/v20230401/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20230401/openshiftcluster_validatestatic_test.go @@ -537,6 +537,48 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, tests) diff --git a/pkg/api/v20230701preview/openshiftcluster_validatestatic.go b/pkg/api/v20230701preview/openshiftcluster_validatestatic.go index b478847f154..98fd41fc748 100644 --- a/pkg/api/v20230701preview/openshiftcluster_validatestatic.go +++ b/pkg/api/v20230701preview/openshiftcluster_validatestatic.go @@ -204,7 +204,6 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile, apiServerVisibility Visibility, ingressVisibility Visibility) error { podIP, pod, err := net.ParseCIDR(np.PodCIDR) - if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } @@ -213,6 +212,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) + } + } + ones, _ := pod.Mask.Size() if ones > 18 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) @@ -233,6 +239,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) + } + } + ones, _ = service.Mask.Size() if ones > 22 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) diff --git a/pkg/api/v20230701preview/openshiftcluster_validatestatic_test.go b/pkg/api/v20230701preview/openshiftcluster_validatestatic_test.go index 9270983cf0b..c97885002ee 100644 --- a/pkg/api/v20230701preview/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20230701preview/openshiftcluster_validatestatic_test.go @@ -572,6 +572,48 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, tests) diff --git a/pkg/api/v20230904/openshiftcluster_validatestatic.go b/pkg/api/v20230904/openshiftcluster_validatestatic.go index 1d26aa70407..d1034a93f3a 100644 --- a/pkg/api/v20230904/openshiftcluster_validatestatic.go +++ b/pkg/api/v20230904/openshiftcluster_validatestatic.go @@ -202,7 +202,6 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile, apiServerVisibility Visibility, ingressVisibility Visibility) error { podIP, pod, err := net.ParseCIDR(np.PodCIDR) - if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } @@ -211,6 +210,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) + } + } + ones, _ := pod.Mask.Size() if ones > 18 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) @@ -231,6 +237,13 @@ func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) + } + } + ones, _ = service.Mask.Size() if ones > 22 { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) diff --git a/pkg/api/v20230904/openshiftcluster_validatestatic_test.go b/pkg/api/v20230904/openshiftcluster_validatestatic_test.go index 1f746a3b98f..12d8ca420de 100644 --- a/pkg/api/v20230904/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20230904/openshiftcluster_validatestatic_test.go @@ -553,6 +553,48 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, tests) diff --git a/pkg/api/v20231122/openshiftcluster_validatestatic.go b/pkg/api/v20231122/openshiftcluster_validatestatic.go index 9fcf751669c..243c9fd5ba9 100644 --- a/pkg/api/v20231122/openshiftcluster_validatestatic.go +++ b/pkg/api/v20231122/openshiftcluster_validatestatic.go @@ -207,33 +207,60 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s } func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile, apiServerVisibility Visibility, ingressVisibility Visibility) error { - _, pod, err := net.ParseCIDR(np.PodCIDR) + podIP, pod, err := net.ParseCIDR(np.PodCIDR) if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } + if pod.IP.To4() == nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } - { - ones, _ := pod.Mask.Size() - if ones > 18 { - return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) + + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) } } - _, service, err := net.ParseCIDR(np.ServiceCIDR) + + ones, _ := pod.Mask.Size() + if ones > 18 { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) + } + + nip := podIP.Mask(pod.Mask) + + if nip.String() != podIP.String() { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidNetworkAddress, path+".podCidr", "The provided pod CIDR '%s' is invalid, expecting: '%s/%d'.", np.PodCIDR, nip.String(), ones) + } + + serviceIP, service, err := net.ParseCIDR(np.ServiceCIDR) if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: '%s'.", np.ServiceCIDR, err) } + if service.IP.To4() == nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } - { - ones, _ := service.Mask.Size() - if ones > 22 { - return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) + + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) } } + ones, _ = service.Mask.Size() + if ones > 22 { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) + } + + nip = serviceIP.Mask(service.Mask) + + if nip.String() != serviceIP.String() { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidNetworkAddress, path+".serviceCidr", "The provided service CIDR '%s' is invalid, expecting: '%s/%d'.", np.ServiceCIDR, nip.String(), ones) + } + if np.OutboundType != "" { if np.OutboundType != OutboundTypeLoadbalancer && np.OutboundType != OutboundTypeUserDefinedRouting { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".outboundType", "The provided outboundType '%s' is invalid: must be UserDefinedRouting or Loadbalancer.", np.OutboundType) diff --git a/pkg/api/v20231122/openshiftcluster_validatestatic_test.go b/pkg/api/v20231122/openshiftcluster_validatestatic_test.go index 2d46f05d432..c16ebbaa742 100644 --- a/pkg/api/v20231122/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20231122/openshiftcluster_validatestatic_test.go @@ -589,6 +589,62 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "", }, + { + name: "podCidr invalid network", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "10.254.0.0/14" + }, + wantErr: "400: InvalidNetworkAddress: properties.networkProfile.podCidr: The provided pod CIDR '10.254.0.0/14' is invalid, expecting: '10.252.0.0/14'.", + }, + { + name: "serviceCidr invalid network", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "10.0.150.0/16" + }, + wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", + }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, tests) diff --git a/pkg/api/v20240812preview/openshiftcluster_validatestatic.go b/pkg/api/v20240812preview/openshiftcluster_validatestatic.go index c027b1cd709..e23477fb1bc 100644 --- a/pkg/api/v20240812preview/openshiftcluster_validatestatic.go +++ b/pkg/api/v20240812preview/openshiftcluster_validatestatic.go @@ -215,33 +215,60 @@ func (sv openShiftClusterStaticValidator) validateServicePrincipalProfile(path s } func (sv openShiftClusterStaticValidator) validateNetworkProfile(path string, np *NetworkProfile, apiServerVisibility Visibility, ingressVisibility Visibility) error { - _, pod, err := net.ParseCIDR(np.PodCIDR) + podIP, pod, err := net.ParseCIDR(np.PodCIDR) if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: '%s'.", np.PodCIDR, err) } + if pod.IP.To4() == nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided pod CIDR '%s' is invalid: must be IPv4.", np.PodCIDR) } - { - ones, _ := pod.Mask.Size() - if ones > 18 { - return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) + + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if pod.Contains(cidr.IP) || cidr.Contains(pod.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.PodCIDR) } } - _, service, err := net.ParseCIDR(np.ServiceCIDR) + + ones, _ := pod.Mask.Size() + if ones > 18 { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".podCidr", "The provided vnet CIDR '%s' is invalid: must be /18 or larger.", np.PodCIDR) + } + + nip := podIP.Mask(pod.Mask) + + if nip.String() != podIP.String() { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidNetworkAddress, path+".podCidr", "The provided pod CIDR '%s' is invalid, expecting: '%s/%d'.", np.PodCIDR, nip.String(), ones) + } + + serviceIP, service, err := net.ParseCIDR(np.ServiceCIDR) if err != nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: '%s'.", np.ServiceCIDR, err) } + if service.IP.To4() == nil { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided service CIDR '%s' is invalid: must be IPv4.", np.ServiceCIDR) } - { - ones, _ := service.Mask.Size() - if ones > 22 { - return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) + + for _, s := range api.JoinCIDRRange { + _, cidr, _ := net.ParseCIDR(s) + if service.Contains(cidr.IP) || cidr.Contains(service.IP) { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidCIDRRange, path, "Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '%s' IP address range in any other CIDR definitions in your cluster.", np.ServiceCIDR) } } + ones, _ = service.Mask.Size() + if ones > 22 { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".serviceCidr", "The provided vnet CIDR '%s' is invalid: must be /22 or larger.", np.ServiceCIDR) + } + + nip = serviceIP.Mask(service.Mask) + + if nip.String() != serviceIP.String() { + return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidNetworkAddress, path+".serviceCidr", "The provided service CIDR '%s' is invalid, expecting: '%s/%d'.", np.ServiceCIDR, nip.String(), ones) + } + if np.OutboundType != "" { if np.OutboundType != OutboundTypeLoadbalancer && np.OutboundType != OutboundTypeUserDefinedRouting { return api.NewCloudError(http.StatusBadRequest, api.CloudErrorCodeInvalidParameter, path+".outboundType", "The provided outboundType '%s' is invalid: must be UserDefinedRouting or Loadbalancer.", np.OutboundType) diff --git a/pkg/api/v20240812preview/openshiftcluster_validatestatic_test.go b/pkg/api/v20240812preview/openshiftcluster_validatestatic_test.go index 97e0b802fb5..260a5855c02 100644 --- a/pkg/api/v20240812preview/openshiftcluster_validatestatic_test.go +++ b/pkg/api/v20240812preview/openshiftcluster_validatestatic_test.go @@ -582,6 +582,62 @@ func TestOpenShiftClusterStaticValidateNetworkProfile(t *testing.T) { }, wantErr: "", }, + { + name: "podCidr invalid network", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "10.254.0.0/14" + }, + wantErr: "400: InvalidNetworkAddress: properties.networkProfile.podCidr: The provided pod CIDR '10.254.0.0/14' is invalid, expecting: '10.252.0.0/14'.", + }, + { + name: "serviceCidr invalid network", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "10.0.150.0/16" + }, + wantErr: "400: InvalidNetworkAddress: properties.networkProfile.serviceCidr: The provided service CIDR '10.0.150.0/16' is invalid, expecting: '10.0.0.0/16'.", + }, + { + name: "podCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "podCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.PodCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-1", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.64.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.64.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-2", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "169.254.169.0/29" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '169.254.169.0/29' IP address range in any other CIDR definitions in your cluster.", + }, + { + name: "serviceCidr invalid CIDR-3", + modify: func(oc *OpenShiftCluster) { + oc.Properties.NetworkProfile.ServiceCIDR = "100.88.0.0/16" + }, + wantErr: "400: InvalidCIDRRange: properties.networkProfile: Azure Red Hat OpenShift uses 100.64.0.0/16, 169.254.169.0/29, 100.88.0.0/16, fd98::/64, fd69::/125, and fd97::/64 IP address range internally. Do not include this '100.88.0.0/16' IP address range in any other CIDR definitions in your cluster.", + }, } runTests(t, testModeCreate, tests)