Fix BackendConfig.securityPolicy is not removed after config updates
rearrange logic
@@ -31,12 +31,11 @@ import (
// EnsureSecurityPolicy ensures the security policy link on backend service.
// TODO(mrhohn): Emit event when attach/detach security policy to backend service.
func EnsureSecurityPolicy(cloud *gce.Cloud, sp utils.ServicePort, be *composite.BackendService) error {
- if sp.BackendConfig.Spec.SecurityPolicy == nil {
- return nil
- }
-
- if be.Scope != meta.Global {
- return fmt.Errorf("cloud armor security policies not supported for %s backend service %s", be.Scope, be.Name)
+ var desiredPolicyName string
+ if sp.BackendConfig.Spec.SecurityPolicy != nil {
+ desiredPolicyName = sp.BackendConfig.Spec.SecurityPolicy.Name
+ } else {
+ desiredPolicyName = ""
}
existingPolicyName, err := utils.KeyName(be.SecurityPolicy)
@@ -44,11 +43,15 @@ func EnsureSecurityPolicy(cloud *gce.Cloud, sp utils.ServicePort, be *composite.
if be.SecurityPolicy != "" && err != nil {
return err
}
- desiredPolicyName := sp.BackendConfig.Spec.SecurityPolicy.Name
+
if existingPolicyName == desiredPolicyName {
return nil
}
+ if be.Scope != meta.Global {
+ return fmt.Errorf("cloud armor security policies not supported for %s backend service %s", be.Scope, be.Name)
+ }
+
klog.V(2).Infof("Set security policy in backend service %s (%s:%s) to %q", be.Name, sp.ID.Service.String(), sp.ID.Port.String(), desiredPolicyName)
if err := composite.SetSecurityPolicy(cloud, be, desiredPolicyName); err != nil {
return fmt.Errorf("failed to set security policy %q for backend service %s (%s:%s): %v", desiredPolicyName, be.Name, sp.ID.Service.String(), sp.ID.Port.String(), err)
