types modifications + conversion + conversion testing

pkg/apis/core/validation/validation.go

@@ -54,6 +54,7 @@ import (
 	"k8s.io/kubernetes/pkg/fieldpath"
 	"k8s.io/kubernetes/pkg/master/ports"
 	"k8s.io/kubernetes/pkg/security/apparmor"
+	netutils "k8s.io/utils/net"
 )
 
 const isNegativeErrorMsg string = apimachineryvalidation.IsNegativeErrorMsg
@@ -3030,6 +3031,44 @@ func ValidatePod(pod *core.Pod) field.ErrorList {
 		allErrs = append(allErrs, field.Invalid(specPath, hugePageResources, "must use a single hugepage size in a pod spec"))
 	}
 
+	podIPsField := field.NewPath("status", "podIPs")
+
+	// all PodIPs must be valid IPs
+	for i, podIP := range pod.Status.PodIPs {
+		for _, msg := range validation.IsValidIP(podIP.IP) {
+			allErrs = append(allErrs, field.Invalid(podIPsField.Index(i), podIP.IP, msg))
+		}
+	}
+
+	// if we have more than one Pod.PodIP then
+	// - validate for dual stack
+	// - validate for duplication
+	if len(pod.Status.PodIPs) > 1 {
+		podIPs := make([]string, 0, len(pod.Status.PodIPs))
+		for _, podIP := range pod.Status.PodIPs {
+			podIPs = append(podIPs, podIP.IP)
+		}
+
+		dualStack, err := netutils.IsDualStackIPStrings(podIPs)
+		if err != nil {
+			allErrs = append(allErrs, field.InternalError(podIPsField, fmt.Errorf("failed to check for dual stack with error:%v", err)))
+		}
+
+		// We only support one from each IP family (i.e. max two IPs in this list).
+		if !dualStack || len(podIPs) > 2 {
+			allErrs = append(allErrs, field.Invalid(podIPsField, pod.Status.PodIPs, "may specify no more than one IP for each IP family"))
+		}
+
+		// There should be no duplicates in list of Pod.PodIPs
+		seen := sets.String{} //:= make(map[string]int)
+		for i, podIP := range pod.Status.PodIPs {
+			if seen.Has(podIP.IP) {
+				allErrs = append(allErrs, field.Duplicate(podIPsField.Index(i), podIP))
+			}
+			seen.Insert(podIP.IP)
+		}
+	}
+
 	return allErrs
 }
 
@@ -4205,12 +4244,40 @@ func ValidateNode(node *core.Node) field.ErrorList {
 	// That said, if specified, we need to ensure they are valid.
 	allErrs = append(allErrs, ValidateNodeResources(node)...)
 
-	if len(node.Spec.PodCIDR) != 0 {
-		_, err := ValidateCIDR(node.Spec.PodCIDR)
-		if err != nil {
-			allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "podCIDR"), node.Spec.PodCIDR, "not a valid CIDR"))
+	// validate PodCIDRS only if we need to
+	if len(node.Spec.PodCIDRs) > 0 {
+		podCIDRsField := field.NewPath("spec", "podCIDRs")
+
+		// all PodCIDRs should be valid ones
+		for idx, value := range node.Spec.PodCIDRs {
+			if _, err := ValidateCIDR(value); err != nil {
+				allErrs = append(allErrs, field.Invalid(podCIDRsField.Index(idx), node.Spec.PodCIDRs, "must be valid CIDR"))
+			}
+		}
+
+		// if more than PodCIDR then
+		// - validate for dual stack
+		// - validate for duplication
+		if len(node.Spec.PodCIDRs) > 1 {
+			dualStack, err := netutils.IsDualStackCIDRStrings(node.Spec.PodCIDRs)
+			if err != nil {
+				allErrs = append(allErrs, field.InternalError(podCIDRsField, fmt.Errorf("invalid PodCIDRs. failed to check with dual stack with error:%v", err)))
+			}
+			if !dualStack || len(node.Spec.PodCIDRs) > 2 {
+				allErrs = append(allErrs, field.Invalid(podCIDRsField, node.Spec.PodCIDRs, "may specify no more than one CIDR for each IP family"))
+			}
+
+			// PodCIDRs must not contain duplicates
+			seen := sets.String{}
+			for i, value := range node.Spec.PodCIDRs {
+				if seen.Has(value) {
+					allErrs = append(allErrs, field.Duplicate(podCIDRsField.Index(i), value))
+				}
+				seen.Insert(value)
+			}
 		}
 	}
+
 	return allErrs
 }
 
@@ -4269,12 +4336,20 @@ func ValidateNodeUpdate(node, oldNode *core.Node) field.ErrorList {
 		addresses[address] = true
 	}
 
-	if len(oldNode.Spec.PodCIDR) == 0 {
+	if len(oldNode.Spec.PodCIDRs) == 0 {
 		// Allow the controller manager to assign a CIDR to a node if it doesn't have one.
-		oldNode.Spec.PodCIDR = node.Spec.PodCIDR
+		//this is a no op for a string slice.
+		oldNode.Spec.PodCIDRs = node.Spec.PodCIDRs
 	} else {
-		if oldNode.Spec.PodCIDR != node.Spec.PodCIDR {
-			allErrs = append(allErrs, field.Forbidden(field.NewPath("spec", "podCIDR"), "node updates may not change podCIDR except from \"\" to valid"))
+		// compare the entire slice
+		if len(oldNode.Spec.PodCIDRs) != len(node.Spec.PodCIDRs) {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("spec", "podCIDRs"), "node updates may not change podCIDR except from \"\" to valid"))
+		} else {
+			for idx, value := range oldNode.Spec.PodCIDRs {
+				if value != node.Spec.PodCIDRs[idx] {
+					allErrs = append(allErrs, field.Forbidden(field.NewPath("spec", "podCIDRs"), "node updates may not change podCIDR except from \"\" to valid"))
+				}
+			}
 		}
 	}