Merge pull request #6367 from agullon/fix/reject-feature-gates-with-empty-featureset

OCPBUGS-78594: reject feature gate lists when FeatureSet is empty

Author: openshift-merge-bot[bot]

etcd/vendor/github.com/openshift/microshift/pkg/config/apiserver.go

@@ -187,13 +187,18 @@ func (fg FeatureGates) GoString() string {
 // 4. If FeatureSet is CustomNoUpgrade, CustomNoUpgrade.Enabled/Disabled lists may be set but are not required.
 // 5. Required feature gates cannot be disabled.
 // 6. Feature gates cannot be both enabled and disabled within the same object.
+// 7. If FeatureSet is empty, CustomNoUpgrade and SpecialHandlingSupportExceptionRequired lists must also be empty.
 func (fg *FeatureGates) validateFeatureGates() error {
 	if fg == nil || reflect.DeepEqual(*fg, FeatureGates{}) {
 		return nil
 	}
 
 	switch fg.FeatureSet {
 	case "":
+		if len(fg.CustomNoUpgrade.Enabled) > 0 || len(fg.CustomNoUpgrade.Disabled) > 0 ||
+			len(fg.SpecialHandlingSupportExceptionRequired.Enabled) > 0 || len(fg.SpecialHandlingSupportExceptionRequired.Disabled) > 0 {
+			return fmt.Errorf("CustomNoUpgrade and SpecialHandlingSupportExceptionRequired enabled/disabled lists must be empty when FeatureSet is empty")
+		}
 		return nil
 	case FeatureSetCustomNoUpgrade:
 		// Valid - continue with validation

pkg/config/apiserver.go

@@ -827,7 +827,18 @@ func TestValidate(t *testing.T) {
 				c.ApiServer.FeatureGates.CustomNoUpgrade.Disabled = []string{"feature2"}
 				return c
 			}(),
-			expectErr: false,
+			expectErr: true,
+		},
+		{
+			name: "feature-gates-special-handling-with-feature-set-empty",
+			config: func() *Config {
+				c := mkDefaultConfig()
+				c.ApiServer.FeatureGates.FeatureSet = ""
+				c.ApiServer.FeatureGates.SpecialHandlingSupportExceptionRequired.Enabled = []string{"feature1"}
+				c.ApiServer.FeatureGates.SpecialHandlingSupportExceptionRequired.Disabled = []string{"feature2"}
+				return c
+			}(),
+			expectErr: true,
 		},
 		{
 			name: "feature-gates-custom-no-upgrade-valid",