Allow changing settings on an owned LB

Signed-off-by: Mikkel Oscar Lyderik Larsen <mikkel.larsen@zalando.de>

worker.go

@@ -88,16 +88,6 @@ func (l *loadBalancer) addIngress(certificateARNs []string, ingress *kubernetes.
 		return true
 	}
 
-	if l.ipAddressType != ingress.IPAddressType ||
-		l.scheme != ingress.Scheme ||
-		l.securityGroup != ingress.SecurityGroup ||
-		l.sslPolicy != ingress.SSLPolicy ||
-		l.loadBalancerType != ingress.LoadBalancerType ||
-		l.http2 != ingress.HTTP2 ||
-		l.wafWebACLID != ingress.WAFWebACLID {
-		return false
-	}
-
 	resourceName := fmt.Sprintf("%s/%s", ingress.Namespace, ingress.Name)
 
 	owner := ""
@@ -113,6 +103,23 @@ func (l *loadBalancer) addIngress(certificateARNs []string, ingress *kubernetes.
 		return false
 	}
 
+	// settings that would require a new load balancer no matter if it's
+	// shared or not.
+	if l.ipAddressType != ingress.IPAddressType ||
+		l.scheme != ingress.Scheme ||
+		l.loadBalancerType != ingress.LoadBalancerType ||
+		l.http2 != ingress.HTTP2 {
+		return false
+	}
+
+	// settings that can be changed on an existing load balancer if it's
+	// NOT shared.
+	if ingress.Shared && (l.securityGroup != ingress.SecurityGroup ||
+		l.sslPolicy != ingress.SSLPolicy ||
+		l.wafWebACLID != ingress.WAFWebACLID) {
+		return false
+	}
+
 	// check if we can fit the ingress on the load balancer based on
 	// maxCerts
 	newCerts := 0

worker_test.go

@@ -169,12 +169,31 @@ func TestAddIngress(tt *testing.T) {
 			},
 			added: false,
 		},
+		{
+			name: "Adding/changing WAF, SG or TLS settings on non-shared LB should work",
+			loadBalancer: &loadBalancer{
+				ingresses: make(map[string][]*kubernetes.Ingress),
+				stack: &aws.Stack{
+					OwnerIngress: "foo/bar",
+				},
+				sslPolicy: "ELBSecurityPolicy-2016-08",
+			},
+			ingress: &kubernetes.Ingress{
+				Name:          "bar",
+				Namespace:     "foo",
+				WAFWebACLID:   "WAFZXX",
+				SecurityGroup: "bar",
+				SSLPolicy:     "ELBSecurityPolicy-FS-2018-06",
+				Shared:        false,
+			},
+			added: true,
+		},
 	} {
 		tt.Run(test.name, func(t *testing.T) {
 			assert.Equal(
 				t,
-				test.loadBalancer.addIngress(test.certificateARNs, test.ingress, test.maxCerts),
 				test.added,
+				test.loadBalancer.addIngress(test.certificateARNs, test.ingress, test.maxCerts),
 			)
 		})
 	}