From e4518f7b13dbad90e6766a5337d083557f4aaf6e Mon Sep 17 00:00:00 2001
From: Jeff Bradberry <jeff.bradberry@gmail.com>
Date: Thu, 28 Jul 2022 14:29:31 -0400
Subject: [PATCH] Changes in posting constraints due to rescoping to
 OCP/K8S-only

- node_state is now read only
- node_state gets set automatically to Installed in the create view
- raise a validation error when creating on non-K8S
- allow SystemAdministrator the 'add' permission for Instances
- expose the new listener_port field
---
 awx/api/serializers.py    | 84 +++++++++++++++++----------------------
 awx/api/views/__init__.py |  3 ++
 awx/main/access.py        |  2 +-
 3 files changed, 41 insertions(+), 48 deletions(-)

diff --git a/awx/api/serializers.py b/awx/api/serializers.py
index 7ca485bd27..48efd6a204 100644
--- a/awx/api/serializers.py
+++ b/awx/api/serializers.py
@@ -4877,40 +4877,40 @@ class InstanceSerializer(BaseSerializer):
     percent_capacity_remaining = serializers.SerializerMethodField()
     jobs_running = serializers.IntegerField(help_text=_('Count of jobs in the running or waiting state that are targeted for this instance'), read_only=True)
     jobs_total = serializers.IntegerField(help_text=_('Count of all jobs that target this instance'), read_only=True)
-    ip_address = serializers.IPAddressField(required=False)
 
     class Meta:
         model = Instance
-        read_only_fields = ('uuid', 'version')
+        read_only_fields = ('ip_address', 'uuid', 'version', 'node_state')
         fields = (
-            "id",
-            "type",
-            "url",
-            "related",
-            "summary_fields",
-            "uuid",
-            "hostname",
-            "created",
-            "modified",
-            "last_seen",
-            "last_health_check",
-            "errors",
+            'id',
+            'type',
+            'url',
+            'related',
+            'summary_fields',
+            'uuid',
+            'hostname',
+            'created',
+            'modified',
+            'last_seen',
+            'last_health_check',
+            'errors',
             'capacity_adjustment',
-            "version",
-            "capacity",
-            "consumed_capacity",
-            "percent_capacity_remaining",
-            "jobs_running",
-            "jobs_total",
-            "cpu",
-            "memory",
-            "cpu_capacity",
-            "mem_capacity",
-            "enabled",
-            "managed_by_policy",
-            "node_type",
-            "node_state",
-            "ip_address",
+            'version',
+            'capacity',
+            'consumed_capacity',
+            'percent_capacity_remaining',
+            'jobs_running',
+            'jobs_total',
+            'cpu',
+            'memory',
+            'cpu_capacity',
+            'mem_capacity',
+            'enabled',
+            'managed_by_policy',
+            'node_type',
+            'node_state',
+            'ip_address',
+            'listener_port',
         )
 
     def get_related(self, obj):
@@ -4940,30 +4940,20 @@ class InstanceSerializer(BaseSerializer):
         else:
             return float("{0:.2f}".format(((float(obj.capacity) - float(obj.consumed_capacity)) / (float(obj.capacity))) * 100))
 
+    def validate(self, data):
+        if not self.instance and not settings.IS_K8S:
+            raise serializers.ValidationError("Can only create instances on Kubernetes or OpenShift.")
+        return data
+
     def validate_node_type(self, value):
-        # ensure that new node type is execution node-only
         if not self.instance:
             if value not in [Instance.Types.EXECUTION, Instance.Types.HOP]:
-                raise serializers.ValidationError('invalid node_type; can only create execution and hop nodes')
+                raise serializers.ValidationError("Can only create execution and hop nodes.")
         else:
             if self.instance.node_type != value:
-                raise serializers.ValidationError('cannot change node_type')
+                raise serializers.ValidationError("Cannot change node type.")
 
-    def validate_node_state(self, value):
-        if not self.instance:
-            if value not in [Instance.States.PROVISIONING, Instance.States.INSTALLED]:
-                raise serializers.ValidationError('net new execution node creation must be in installed or provisioning node_state')
-        else:
-            if self.instance.node_state != value and value not in [Instance.States.PROVISIONING, Instance.States.INSTALLED, Instance.States.DEPROVISIONING]:
-                raise serializers.ValidationError('modifying an existing instance can only be in provisioning or deprovisoning node_states')
-
-    def validate_peers(self, value):
-        pass
-        # 1- dont wanna remove links between two control plane nodes
-        # 2- can of worms - reversing links
-
-    def validate_instance_group(self, value):
-        pass
+        return value
 
 
 class InstanceHealthCheckSerializer(BaseSerializer):
diff --git a/awx/api/views/__init__.py b/awx/api/views/__init__.py
index 0b2a1a252e..3c282f3e2c 100644
--- a/awx/api/views/__init__.py
+++ b/awx/api/views/__init__.py
@@ -367,6 +367,9 @@ class InstanceList(ListCreateAPIView):
     search_fields = ('hostname',)
     ordering = ('id',)
 
+    def perform_create(self, serializer):
+        serializer.save(node_state=models.Instance.States.INSTALLED)
+
 
 class InstanceDetail(RetrieveUpdateAPIView):
 
diff --git a/awx/main/access.py b/awx/main/access.py
index e8deea8f36..a11789ee81 100644
--- a/awx/main/access.py
+++ b/awx/main/access.py
@@ -579,7 +579,7 @@ class InstanceAccess(BaseAccess):
         return super(InstanceAccess, self).can_unattach(obj, sub_obj, relationship, relationship, data=data)
 
     def can_add(self, data):
-        return False
+        return self.user.is_superuser
 
     def can_change(self, obj, data):
         return False