@@ -372,51 +372,53 @@ func (r *AWSManagedControlPlane) validateAccessConfigCreate() field.ErrorList {
372372func (r * AWSManagedControlPlane ) validateAccessEntries () field.ErrorList {
373373 var allErrs field.ErrorList
374374
375- if len (r .Spec .AccessEntries ) > 0 {
376- // AccessEntries require AuthenticationMode to be api or api_and_config_map
377- if r .Spec .AccessConfig == nil ||
378- (r .Spec .AccessConfig .AuthenticationMode != EKSAuthenticationModeAPI &&
379- r .Spec .AccessConfig .AuthenticationMode != EKSAuthenticationModeAPIAndConfigMap ) {
380- allErrs = append (allErrs ,
381- field .Invalid (field .NewPath ("spec" , "accessEntries" ),
382- r .Spec .AccessEntries ,
383- "accessEntries can only be used when authenticationMode is set to api or api_and_config_map" ,
384- ),
385- )
386- }
375+ if len (r .Spec .AccessEntries ) == 0 {
376+ return allErrs
377+ }
387378
388- for i , entry := range r . Spec . AccessEntries {
389- // Validate that EC2 types don't have kubernetes groups or access policies
390- if entry . Type == AccessEntryTypeEC2Linux || entry . Type == AccessEntryTypeEC2Windows {
391- if len ( entry . KubernetesGroups ) > 0 {
392- allErrs = append (allErrs ,
393- field .Invalid (field .NewPath ("spec" , "accessEntries" ). Index ( i ). Child ( "kubernetesGroups " ),
394- entry . KubernetesGroups ,
395- "kubernetesGroups cannot be specified when type is ec2_linux or ec2_windows " ,
396- ),
397- )
398- }
379+ // AccessEntries require AuthenticationMode to be api or api_and_config_map
380+ if r . Spec . AccessConfig == nil ||
381+ ( r . Spec . AccessConfig . AuthenticationMode != EKSAuthenticationModeAPI &&
382+ r . Spec . AccessConfig . AuthenticationMode != EKSAuthenticationModeAPIAndConfigMap ) {
383+ allErrs = append (allErrs ,
384+ field .Invalid (field .NewPath ("spec" , "accessEntries" ),
385+ r . Spec . AccessEntries ,
386+ "accessEntries can only be used when authenticationMode is set to api or api_and_config_map " ,
387+ ),
388+ )
389+ }
399390
400- if len (entry .AccessPolicies ) > 0 {
401- allErrs = append (allErrs ,
402- field .Invalid (field .NewPath ("spec" , "accessEntries" ).Index (i ).Child ("accessPolicies" ),
403- entry .AccessPolicies ,
404- "accessPolicies cannot be specified when type is ec2_linux or ec2_windows" ,
405- ),
406- )
407- }
391+ for i , entry := range r .Spec .AccessEntries {
392+ // Validate that EC2 types don't have kubernetes groups or access policies
393+ if entry .Type == AccessEntryTypeEC2Linux || entry .Type == AccessEntryTypeEC2Windows {
394+ if len (entry .KubernetesGroups ) > 0 {
395+ allErrs = append (allErrs ,
396+ field .Invalid (field .NewPath ("spec" , "accessEntries" ).Index (i ).Child ("kubernetesGroups" ),
397+ entry .KubernetesGroups ,
398+ "kubernetesGroups cannot be specified when type is ec2_linux or ec2_windows" ,
399+ ),
400+ )
408401 }
409402
410- // Validate namespace scopes
411- for j , policy := range entry .AccessPolicies {
412- if policy .AccessScope .Type == AccessScopeTypeNamespace && len (policy .AccessScope .Namespaces ) == 0 {
413- allErrs = append (allErrs ,
414- field .Invalid (field .NewPath ("spec" , "accessEntries" ).Index (i ).Child ("accessPolicies" ).Index (j ).Child ("accessScope" , "namespaces" ),
415- policy .AccessScope .Namespaces ,
416- "at least one value must be provided when accessScope type is namespace" ,
417- ),
418- )
419- }
403+ if len (entry .AccessPolicies ) > 0 {
404+ allErrs = append (allErrs ,
405+ field .Invalid (field .NewPath ("spec" , "accessEntries" ).Index (i ).Child ("accessPolicies" ),
406+ entry .AccessPolicies ,
407+ "accessPolicies cannot be specified when type is ec2_linux or ec2_windows" ,
408+ ),
409+ )
410+ }
411+ }
412+
413+ // Validate namespace scopes
414+ for j , policy := range entry .AccessPolicies {
415+ if policy .AccessScope .Type == AccessScopeTypeNamespace && len (policy .AccessScope .Namespaces ) == 0 {
416+ allErrs = append (allErrs ,
417+ field .Invalid (field .NewPath ("spec" , "accessEntries" ).Index (i ).Child ("accessPolicies" ).Index (j ).Child ("accessScope" , "namespaces" ),
418+ policy .AccessScope .Namespaces ,
419+ "at least one value must be provided when accessScope type is namespace" ,
420+ ),
421+ )
420422 }
421423 }
422424 }
0 commit comments