From e52480ecc6251a5f43ac4ca6f0f7e27a486bfbda Mon Sep 17 00:00:00 2001 From: John Gardiner Myers Date: Fri, 13 Jan 2023 19:23:00 -0800 Subject: [PATCH] Validate nonMasqueradeCIDR doesn't overlap additionalNetworkCIDRs --- pkg/apis/kops/validation/validation.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/pkg/apis/kops/validation/validation.go b/pkg/apis/kops/validation/validation.go index e6614e944b..28071d1b1e 100644 --- a/pkg/apis/kops/validation/validation.go +++ b/pkg/apis/kops/validation/validation.go @@ -937,8 +937,15 @@ func validateNetworking(cluster *kops.Cluster, v *kops.NetworkingSpec, fldPath * allErrs = append(allErrs, field.Forbidden(fldPath.Child("nonMasqueradeCIDR"), "IPv6 clusters must have a nonMasqueradeCIDR of \"::/0\"")) } - if len(networkCIDRs) > 0 && subnet.Overlap(nonMasqueradeCIDRs[0], networkCIDRs[0]) && v.AmazonVPC == nil && (v.Cilium == nil || v.Cilium.IPAM != kops.CiliumIpamEni) { - allErrs = append(allErrs, field.Forbidden(fldPath.Child("nonMasqueradeCIDR"), fmt.Sprintf("nonMasqueradeCIDR %q cannot overlap with networkCIDR %q", v.NonMasqueradeCIDR, v.NetworkCIDR))) + if len(networkCIDRs) > 0 && v.AmazonVPC == nil && (v.Cilium == nil || v.Cilium.IPAM != kops.CiliumIpamEni) { + if subnet.Overlap(nonMasqueradeCIDRs[0], networkCIDRs[0]) { + allErrs = append(allErrs, field.Forbidden(fldPath.Child("nonMasqueradeCIDR"), fmt.Sprintf("nonMasqueradeCIDR %q cannot overlap with networkCIDR %q", v.NonMasqueradeCIDR, v.NetworkCIDR))) + } + for i, cidr := range networkCIDRs[1:] { + if subnet.Overlap(nonMasqueradeCIDRs[0], cidr) { + allErrs = append(allErrs, field.Forbidden(fldPath.Child("nonMasqueradeCIDR"), fmt.Sprintf("nonMasqueradeCIDR %q cannot overlap with additionalNetworkCIDRs[%d] %q", v.NonMasqueradeCIDR, i, cidr))) + } + } } } }