OSSM-1188 Remove ServiceMeshExtension support

build/patch-charts.sh

@@ -97,15 +97,6 @@ function patchGalley() {
         - "*"\
         resources:\
         - "*"\
-      - operations:\
-        - CREATE\
-        - UPDATE\
-        apiGroups:\
-        - maistra.io\
-        apiVersions:\
-        - "*"\
-        resources:\
-        - "servicemeshextensions"\
       - operations:\
         - CREATE\
         - UPDATE\
@@ -136,9 +127,6 @@ function patchGalley() {
   - apiGroups: ["route.openshift.io"]\
     resources: ["routes", "routes/custom-host"]\
     verbs: ["get", "list", "watch", "create", "delete", "update"]\
-  - apiGroups: ["maistra.io"]\
-    resources: ["servicemeshextensions"]\
-    verbs: ["get", "list", "watch"]\
   # Allow use of blockOwnerDeletion in ownerReferences pointing to Pods (see OSSM-1321)\
   - apiGroups: [""]\
     resources: ["pods/finalizers"]\

pkg/controller/servicemesh/webhooks/validation/controlplane_test.go

@@ -8,6 +8,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	apiv1 "maistra.io/api/core/v1"
 	webhookadmission "sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	maistrav1 "github.com/maistra/istio-operator/pkg/apis/maistra/v1"
@@ -66,10 +67,11 @@ func TestControlPlaneValidation(t *testing.T) {
 	enabled := true
 	disabled := false
 	cases := []struct {
-		name         string
-		controlPlane runtime.Object
-		valid        bool
-		resources    []runtime.Object
+		name                string
+		controlPlane        runtime.Object
+		updatedControlPlane runtime.Object
+		valid               bool
+		resources           []runtime.Object
 	}{
 		{
 			name:         "blank-version",
@@ -823,12 +825,41 @@ func TestControlPlaneValidation(t *testing.T) {
 			},
 			valid: true,
 		},
+		{
+			name:                "smcp.upgrade.v2.0.to.v2.3",
+			controlPlane:        newControlPlaneWithVersion("basic", "istio-system", versions.V2_0.String()),
+			updatedControlPlane: newControlPlaneWithVersion("basic", "istio-system", versions.V2_3.String()),
+			valid:               true,
+		},
+		{
+			name:                "sme.upgrade.to.v2.3.fail",
+			controlPlane:        newControlPlaneWithVersion("basic", "istio-system", versions.V2_2.String()),
+			updatedControlPlane: newControlPlaneWithVersion("basic", "istio-system", versions.V2_3.String()),
+			valid:               false,
+			resources: []runtime.Object{
+				&apiv1.ServiceMeshExtension{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test",
+						Namespace: "istio-system",
+					},
+					Spec: apiv1.ServiceMeshExtensionSpec{
+						Config: apiv1.ServiceMeshExtensionConfig{
+							Data: map[string]interface{}{},
+						},
+					},
+				},
+			},
+		},
 	}
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			validator := createControlPlaneValidatorTestFixture(tc.resources...)
 			response := validator.Handle(ctx, createCreateRequest(tc.controlPlane))
+			if tc.updatedControlPlane != nil {
+				response = validator.Handle(ctx, createUpdateRequest(tc.controlPlane, tc.updatedControlPlane))
+			}
+
 			if tc.valid {
 				var reason string
 				if response.Result != nil {
@@ -982,15 +1013,6 @@ func TestFullAffinityOnlySupportedForKiali(t *testing.T) {
 	}
 }
 
-func TestUpdateOfValidControlPlane(t *testing.T) {
-	oldControlPlane := newControlPlaneWithVersion("my-smcp", "istio-system", "v2.0")
-	validator := createControlPlaneValidatorTestFixture(oldControlPlane)
-
-	controlPlane := newControlPlaneWithVersion("my-smcp", "istio-system", "v2.1")
-	response := validator.Handle(ctx, createUpdateRequest(oldControlPlane, controlPlane))
-	assert.True(response.Allowed, "Expected validator to accept update of valid ServiceMeshControlPlane", t)
-}
-
 func TestInvalidVersion(t *testing.T) {
 	validControlPlane := newControlPlaneWithVersion("my-smcp", "istio-system", "v1.0")
 	invalidControlPlane := newControlPlaneWithVersion("my-smcp", "istio-system", "InvalidVersion")

pkg/controller/versions/strategy_v2_3.go

@@ -17,6 +17,7 @@ import (
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/helm/pkg/chartutil"
 	"k8s.io/helm/pkg/manifest"
+	apiv1 "maistra.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 	"sigs.k8s.io/yaml"
@@ -248,6 +249,39 @@ func (v *versionStrategyV2_3) validateAddons(spec *v2.ControlPlaneSpec, allError
 	return allErrors
 }
 
+func (v *versionStrategyV2_3) validateServiceMeshExtensionsRemoved(ctx context.Context, cl client.Client, smcp metav1.Object) error {
+	serviceMeshExtensions := &apiv1.ServiceMeshExtensionList{}
+	if err := cl.List(ctx, serviceMeshExtensions); err != nil {
+		if !errors.IsNotFound(err) && !meta.IsNoMatchError(err) {
+			return NewValidationError(fmt.Errorf("upgrade validation failed: failed to list ServiceMeshExtensions in cluster (error: %s)",
+				err,
+			))
+		}
+	}
+	if len(serviceMeshExtensions.Items) > 0 {
+		smmr := &v1.ServiceMeshMemberRoll{}
+		err := cl.Get(ctx, client.ObjectKey{Name: common.MemberRollName, Namespace: smcp.GetNamespace()}, smmr)
+		if err != nil {
+			if !errors.IsNotFound(err) {
+				return NewValidationError(fmt.Errorf("upgrade validation failed: failed to retrieve SMMR for SMCP (error: %s)",
+					err,
+				))
+			}
+		}
+		meshNamespaces := common.GetMeshNamespaces(smcp.GetNamespace(), smmr)
+		for _, sme := range serviceMeshExtensions.Items {
+			if meshNamespaces.Has(sme.Namespace) {
+				return NewValidationError(fmt.Errorf("found a ServiceMeshExtension '%s' in namespace '%s'. "+
+					"ServiceMeshExtension support has been removed; please migrate existing ServiceMeshExtensions to WasmPlugin",
+					sme.Name,
+					sme.Namespace,
+				))
+			}
+		}
+	}
+	return nil
+}
+
 func (v *versionStrategyV2_3) ValidateV2Full(ctx context.Context, cl client.Client, meta *metav1.ObjectMeta, spec *v2.ControlPlaneSpec) error {
 	var allErrors []error
 	err := v.ValidateV2(ctx, cl, meta, spec)
@@ -269,8 +303,7 @@ func (v *versionStrategyV2_3) ValidateDowngrade(ctx context.Context, cl client.C
 }
 
 func (v *versionStrategyV2_3) ValidateUpgrade(ctx context.Context, cl client.Client, smcp metav1.Object) error {
-	// TODO: what might prevent us from upgrading?
-	return nil
+	return v.validateServiceMeshExtensionsRemoved(ctx, cl, smcp)
 }
 
 func (v *versionStrategyV2_3) ValidateUpdate(ctx context.Context, cl client.Client, oldSMCP, newSMCP metav1.Object) error {