🐛 clusterclass: fix nil pointer for empty workers in webhook

[chrischdi]

What this PR does / why we need it:

When creating a cluster without defining any workers:

apiVersion: cluster.x-k8s.io/v1beta1
kind: Cluster
metadata:
  name: test
  namespace: default
spec:
  topology:
    class: quick-start
    controlPlane:
      metadata: {}
      replicas: 1
    variables:
    version: v1.31.0
    # workers:

The reconciliation fails because the cluster cannot be patched anymore because the webhook panic's. This is visible in the cluster's status condition and when trying to patch the cluster (e.g. adding workers):

...
status:
  conditions:
  - lastTransitionTime: "2024-09-19T06:57:27Z"
    message: 'error reconciling the Cluster topology: failed to mark "AfterControlPlaneInitialized"
      hook(s) as pending: failed to patch Cluster default/test: admission webhook
      "default.cluster.cluster.x-k8s.io" denied the request: panic: runtime error:
      invalid memory address or nil pointer dereference [recovered]'

❯ k apply -f cluster.yaml
Error from server: error when applying patch:
{"metadata":{"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{\"apiVersion\":\"cluster.x-k8s.io/v1beta1\",\"kind\":\"Cluster\",\"metadata\":{\"annotations\":{},\"name\":\"test\",\"namespace\":\"default\"},\"spec\":{\"topology\":{\"class\":\"quick-start\",\"controlPlane\":{\"metadata\":{},\"replicas\":1},\"variables\":null,\"version\":\"v1.31.0\",\"workers\":{\"machineDeployments\":[{\"class\":\"default-worker\",\"metadata\":{},\"name\":\"md-0\",\"replicas\":0}]}}}}\n"}},"spec":{"topology":{"workers":{"machineDeployments":[{"class":"default-worker","metadata":{},"name":"md-0","replicas":0}]}}}}
to:
Resource: "cluster.x-k8s.io/v1beta1, Resource=clusters", GroupVersionKind: "cluster.x-k8s.io/v1beta1, Kind=Cluster"
Name: "test", Namespace: "default"
for: "cluster.yaml": error when patching "cluster.yaml": admission webhook "default.cluster.cluster.x-k8s.io" denied the request: panic: runtime error: invalid memory address or nil pointer dereference [recovered]

The detailed stacktrace from the logs:

E0919 06:58:49.341383      20 signal_unix.go:881] "Observed a panic" logger="admission" webhookGroup="cluster.x-k8s.io" webhookKind="Cluster" Cluster="default/test" namespace="default" name="test" resource={"group":"cluster.x-k8s.io","version":"v1beta1","resource":"clusters"} user="system:serviceaccount:capi-system:capi-manager" requestID="1141264c-8de3-4b31-9b9e-d328162a593e" panic="runtime error: invalid memory address or nil pointer dereference" panicGoValue="\"invalid memory addres
s or nil pointer dereference\"" stacktrace=<                                                                                                                                                                                                                 goroutine 2160 [running]:
        k8s.io/apimachinery/pkg/util/runtime.logPanic({0x2aafdd0, 0x400071d860}, {0x24dde00, 0x3c525a0})                                                                                                                                                             /Users/schlotterc/go/pkg/mod/k8s.io/apimachinery@v0.31.0/pkg/util/runtime/runtime.go:107 +0xe4
        sigs.k8s.io/controller-runtime/pkg/webhook/admission.(*Webhook).Handle.func1()                                                                                                                                                                               /Users/schlotterc/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/webhook/admission/webhook.go:163 +0x158
        panic({0x24dde00?, 0x3c525a0?})                                                                                                                                                                                                                              /Users/schlotterc/.bin/go-archive/go1.22.1.darwin-arm64/src/runtime/panic.go:770 +0xf0
        sigs.k8s.io/cluster-api/internal/webhooks.DefaultAndValidateVariables({0x2aafdd0, 0x400071d890}, 0x40013d41a0, 0x40013d4ea0, 0x400085d600)                                                                                                                   /Users/schlotterc/go/src/sigs.k8s.io/cluster-api/internal/webhooks/cluster.go:775 +0x1dc
        sigs.k8s.io/cluster-api/internal/webhooks.(*Cluster).Default(0x400085aab0, {0x2aafdd0, 0x400071d890}, {0x2a96340, 0x40013d41a0})                                                                                                                             /Users/schlotterc/go/src/sigs.k8s.io/cluster-api/internal/webhooks/cluster.go:162 +0xbd8
        sigs.k8s.io/controller-runtime/pkg/webhook/admission.(*defaulterForType).Handle(_, {_, _}, {{{0x4000fd98c0, 0x24}, {{0x40010aac50, 0x10}, {0x40010aac28, 0x7}, {0x40010aac60, ...}}, ...}})                                                                  /Users/schlotterc/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/webhook/admission/defaulter_custom.go:80 +0x3e0
        sigs.k8s.io/controller-runtime/pkg/webhook/admission.(*Webhook).Handle(_, {_, _}, {{{0x4000fd98c0, 0x24}, {{0x40010aac50, 0x10}, {0x40010aac28, 0x7}, {0x40010aac60, ...}}, ...}})                                                                           /Users/schlotterc/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/webhook/admission/webhook.go:181 +0x264
        sigs.k8s.io/controller-runtime/pkg/webhook/admission.(*Webhook).ServeHTTP(0x4000858870, {0xe14f5da398f0, 0x40016b1810}, 0x4000e98360)                                                                                                                        /Users/schlotterc/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/webhook/admission/http.go:119 +0xeb0
        github.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerInFlight.func1({0xe14f5da398f0, 0x40016b1810}, 0x4000e98360)                                                                                                                        /Users/schlotterc/go/pkg/mod/github.com/prometheus/client_golang@v1.19.1/prometheus/promhttp/instrument_server.go:60 +0x104
        net/http.HandlerFunc.ServeHTTP(0x400085b080, {0xe14f5da398f0, 0x40016b1810}, 0x4000e98360)                                                                                                                                                                   /Users/schlotterc/.bin/go-archive/go1.22.1.darwin-arm64/src/net/http/server.go:2166 +0x40
        github.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerCounter.func1({0x2aac8a0, 0x4000cb4fc0}, 0x4000e98360)                                                                                                                              /Users/schlotterc/go/pkg/mod/github.com/prometheus/client_golang@v1.19.1/prometheus/promhttp/instrument_server.go:147 +0xd0
        net/http.HandlerFunc.ServeHTTP(0x400085b290, {0x2aac8a0, 0x4000cb4fc0}, 0x4000e98360)                                                                                                                                                                        /Users/schlotterc/.bin/go-archive/go1.22.1.darwin-arm64/src/net/http/server.go:2166 +0x40
        github.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerDuration.func2({0x2aac8a0, 0x4000cb4fc0}, 0x4000e98360)                                                                                                                             /Users/schlotterc/go/pkg/mod/github.com/prometheus/client_golang@v1.19.1/prometheus/promhttp/instrument_server.go:109 +0x9c
        net/http.HandlerFunc.ServeHTTP(0x4000857e80, {0x2aac8a0, 0x4000cb4fc0}, 0x4000e98360)                                                                                                                                                                        /Users/schlotterc/.bin/go-archive/go1.22.1.darwin-arm64/src/net/http/server.go:2166 +0x40
        net/http.(*ServeMux).ServeHTTP(0x40004c6ea0, {0x2aac8a0, 0x4000cb4fc0}, 0x4000e98360)                                                                                                                                                                        /Users/schlotterc/.bin/go-archive/go1.22.1.darwin-arm64/src/net/http/server.go:2683 +0x29c
        net/http.serverHandler.ServeHTTP({0x40005ec000}, {0x2aac8a0, 0x4000cb4fc0}, 0x4000e98360)                                                                                                                                                                    /Users/schlotterc/.bin/go-archive/go1.22.1.darwin-arm64/src/net/http/server.go:3137 +0x2a0
        net/http.(*conn).serve(0x40013baea0, {0x2aafe08, 0x4001a892c0})
                /Users/schlotterc/.bin/go-archive/go1.22.1.darwin-arm64/src/net/http/server.go:2039 +0x15f8
        created by net/http.(*Server).Serve in goroutine 210
                /Users/schlotterc/.bin/go-archive/go1.22.1.darwin-arm64/src/net/http/server.go:3285 +0x88c
 >

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

/area clusterclass

[chrischdi]

/cherry-pick release-1.8

[k8s-infra-cherrypick-robot]

@chrischdi: once the present PR merges, I will cherry-pick it on top of release-1.8 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[chrischdi]

/cherry-pick release-1.7

[k8s-infra-cherrypick-robot]

@chrischdi: once the present PR merges, I will cherry-pick it on top of release-1.7 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[chrischdi]

/assign @fabriziopandini @sbueringer

[fabriziopandini]

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 8a902a10dda4e7f92be5eea52ac12900fc686a02

[sbueringer]

Thx!

/lgtm
/appprove

[sbueringer]

1.7 should not be affected. This code was added with CEL :/. Closely reviewed this part for nil pointer at the time but still missed it :/

[sbueringer]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sbueringer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-infra-cherrypick-robot]

@chrischdi: new pull request created: #11198

In response to this:

/cherry-pick release-1.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-infra-cherrypick-robot]

@chrischdi: #11197 failed to apply on top of branch "release-1.7":

Applying: clusterclass: fix nil pointer for empty workers in webhook
Using index info to reconstruct a base tree...
M	internal/webhooks/cluster.go
M	internal/webhooks/cluster_test.go
Falling back to patching base and 3-way merge...
Auto-merging internal/webhooks/cluster_test.go
Auto-merging internal/webhooks/cluster.go
CONFLICT (content): Merge conflict in internal/webhooks/cluster.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 clusterclass: fix nil pointer for empty workers in webhook
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.