return Forbidden is appropriate (#1826)

Signed-off-by: 李龙峰 <[email protected]>
openyurtio · Dec 7, 2023 · 4bd9e61 · 4bd9e61
1 parent 6362870
commit 4bd9e61
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 8 deletions.
diff --git a/pkg/yurtmanager/webhook/nodepool/v1beta1/nodepool_validation.go b/pkg/yurtmanager/webhook/nodepool/v1beta1/nodepool_validation.go
@@ -58,7 +58,7 @@ func (webhook *NodePoolHandler) ValidateUpdate(ctx context.Context, oldObj, newO
 	}
 
 	if allErrs := validateNodePoolSpecUpdate(&newNp.Spec, &oldNp.Spec); len(allErrs) > 0 {
-		return apierrors.NewInvalid(appsv1beta1.GroupVersion.WithKind("NodePool").GroupKind(), newNp.Name, allErrs)
+		return apierrors.NewForbidden(appsv1beta1.GroupVersion.WithResource("nodepools").GroupResource(), newNp.Name, allErrs[0])
 	}
 
 	return nil
@@ -71,7 +71,7 @@ func (webhook *NodePoolHandler) ValidateDelete(_ context.Context, obj runtime.Ob
 		return apierrors.NewBadRequest(fmt.Sprintf("expected a NodePool but got a %T", obj))
 	}
 	if allErrs := validateNodePoolDeletion(webhook.Client, np); len(allErrs) > 0 {
-		return apierrors.NewInvalid(appsv1beta1.GroupVersion.WithKind("NodePool").GroupKind(), np.Name, allErrs)
+		return apierrors.NewForbidden(appsv1beta1.GroupVersion.WithResource("nodepools").GroupResource(), np.Name, allErrs[0])
 	}
 
 	return nil
@@ -121,12 +121,12 @@ func validateNodePoolSpecUpdate(spec, oldSpec *appsv1beta1.NodePoolSpec) field.E
 
 	if spec.Type != oldSpec.Type {
 		return field.ErrorList([]*field.Error{
-			field.Invalid(field.NewPath("spec").Child("type"), spec.Type, "pool type can't be changed")})
+			field.Forbidden(field.NewPath("spec").Child("type"), "pool type can't be changed")})
 	}
 
 	if spec.HostNetwork != oldSpec.HostNetwork {
 		return field.ErrorList([]*field.Error{
-			field.Invalid(field.NewPath("spec").Child("hostNetwork"), spec.HostNetwork, "pool hostNetwork can't be changed"),
+			field.Forbidden(field.NewPath("spec").Child("hostNetwork"), "pool hostNetwork can't be changed"),
 		})
 	}
 	return nil

diff --git a/pkg/yurtmanager/webhook/nodepool/v1beta1/nodepool_validation_test.go b/pkg/yurtmanager/webhook/nodepool/v1beta1/nodepool_validation_test.go
@@ -131,7 +131,7 @@ func TestValidateUpdate(t *testing.T) {
 					Type: "invalid type",
 				},
 			},
-			errcode: http.StatusUnprocessableEntity,
+			errcode: http.StatusForbidden,
 		},
 		"type is changed": {
 			oldPool: &appsv1beta1.NodePool{
@@ -144,7 +144,7 @@ func TestValidateUpdate(t *testing.T) {
 					Type: appsv1beta1.Cloud,
 				},
 			},
-			errcode: http.StatusUnprocessableEntity,
+			errcode: http.StatusForbidden,
 		},
 		"host network is changed": {
 			oldPool: &appsv1beta1.NodePool{
@@ -159,7 +159,7 @@ func TestValidateUpdate(t *testing.T) {
 					HostNetwork: true,
 				},
 			},
-			errcode: http.StatusUnprocessableEntity,
+			errcode: http.StatusForbidden,
 		},
 	}
 
@@ -258,7 +258,7 @@ func TestValidateDelete(t *testing.T) {
 					Name: "hangzhou",
 				},
 			},
-			errcode: http.StatusUnprocessableEntity,
+			errcode: http.StatusForbidden,
 		},
 		"it is not a nodepool": {
 			pool:    &corev1.Node{},