telekom/cluster-api-ipam-provider-infoblox v0.3.0-rc.0

on GitHub

What's Changed

🚨 Highlights

The InfobloxIPPool validating/mutating webhook never fired in any released version — its kubebuilder markers declared versions=v1alpha2 while v1alpha1 is the only API version that exists. This release fixes that, which means admission control becomes active for the first time. Pools that are invalid under the (previously dormant) rules may already exist in your clusters — see Upgrade notes.

Allocation is now gated on pool readiness, address release no longer depends on the pool's current subnet list, and transient Infoblox faults are retried instead of being reported as permanent configuration errors.

Upgrade notes

• Admission is now live. Existing InfobloxIPPool objects that were accepted while the webhook was inert (e.g. non-canonical CIDRs, duplicate subnet entries) will be rejected on their next update. Reconcile your pool specs before upgrading. Deletion of such pools still works — spec validation is skipped once deletionTimestamp is set.
• Stricter readiness gate. Claims against pools that have never successfully reconciled are now refused instead of silently allocated. Deleting claims are exempt so address release is never blocked.
• Release path changed. New allocations record the Infoblox instance, network view and DNS view on the IPAddress. Addresses allocated by earlier versions release via the previous behaviour; verify no stale reservations remain after upgrading.

✨ Features

• feat: improve IPPool Subnet API validations by @Arakos in #172 (a47fa49)
  • Subnet entries must be unique by CIDR
  • cidr and gateway are validated as plausible CIDR/IP values

🐛 Fixes

• fix: make the claim and pool lifecycle safe and rework the controller tests by @Arakos in #172
  • FetchPool discarded the API NotFound error, so callers matching on that error type mishandled genuinely missing pools (8f59042)
  • InfobloxIPPool identity is no longer derived from TypeMeta — GVK presence depends on the backing client, and upstream ipamutil.ClaimHandler requires it to be set (a9694a6)
  • Failed Infoblox lookups (CheckNetworkViewExists and siblings) are no longer collapsed into "not found": they now set InfobloxCheckFailed and return the error so controller-runtime retries with backoff (008ef19)
  • Allocation treats anything other than Ready=True as not ready, so a never-reconciled pool is no longer served from; the gate is skipped for claims being deleted so a not-ready pool cannot make every dependent Machine and Cluster undeletable (8eaaa83)
  • Addresses are released against what the IPAddress records (instance, network view, DNS view, and the subnet reconstructed from spec.address/spec.prefix) instead of guessing across the pool's current subnets — an address in a since-removed subnet could previously never be released. Failures now surface as a ReleaseFailed condition and keep the finalizer (ad30c05)
  • Pool deletion is double-checked against the API server when the cache finds no referencing claims, and waiting for claims to drain requeues on a fixed cadence with a condition naming the blocking claims instead of erroring (772b23e)
  • Dropped the unused in-cluster IPAM provider scheme registration (ca5ea5b)
• fix(webhook): target v1alpha1 so admission actually fires by @MaxRink in #170
  • Corrected both webhook markers and regenerated config/webhook/manifests.yaml (a250d5f)
  • Fixed two latent bugs the inert webhook was hiding: an unparseable CIDR dereferenced a nil *net.IPNet and panicked the webhook server (fatal under failurePolicy=Fail), and an unset optional Subnet.Gateway was wrongly rejected (a250d5f)
  • Spec validation is skipped once deletionTimestamp is set, so the finalizer-removing update cannot be rejected for legacy-invalid pools — which would strand them in Terminating permanently (99f1189)
• fix: gate IPAddressClaim allocation on pool readiness by @MaxRink in #156
  • Claims are requeued when their referenced InfobloxIPPool changes, via the pool-reference field index — removing multi-minute backoff delays after a pool becomes ready
  • Distinguishes a not-ready pool from a pool with no Ready condition at all

🧪 Testing & Chores

• test: rework the controller suite for isolation and determinism by @Arakos in #172 (59869d1)
  • Fixed a genuine data race reported by go test -race in the shared mock scaffolding
  • Specs construct their own reconciler with injected dependencies and drive Reconcile directly; fixtures are namespace-scoped and gomock controllers are per-spec with exact call counts
  • InfobloxProviderAdapter holds its function references instead of reaching for package-level variables; index.SetupIndexes takes a client.FieldIndexer instead of a manager (no behaviour change)
  • make test now runs with -race -shuffle=on, overridable via TEST_ARGS
  • 65 specs (up from 44), runtime down from ~69s to ~18s
• chore: add lint targets to the Makefile by @Arakos in #172 (6bea166) — pinned to the same golangci-lint version as CI
• chore: fix copy-paste errors in some licensing headers by @Arakos in #172 (c83e160)

Full Changelog: v0.2.3...v0.3.0