Update

Dockerfile.test

@@ -1,4 +1,4 @@
-FROM golang:1.21
+FROM golang:1.22
 WORKDIR /work
 COPY go.* .
 RUN go mod download

cmd/completion/image.go

@@ -2,10 +2,13 @@ package completion
 
 import (
 	"errors"
+	"slices"
 	"strings"
+	"time"
 
 	"github.com/metal-stack/metal-go/api/client/image"
 	"github.com/metal-stack/metal-go/api/models"
+	"github.com/metal-stack/metal-lib/pkg/pointer"
 	"github.com/spf13/cobra"
 )
 
@@ -20,8 +23,19 @@ func (c *Completion) ImageClassificationCompletion(cmd *cobra.Command, args []st
 func (c *Completion) ImageFeatureCompletion(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 	return []string{"machine", "firewall"}, cobra.ShellCompDirectiveNoFileComp
 }
+func (c *Completion) FirewallImageListCompletion(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	return c.listValidImages(pointer.Pointer(models.V1MachineAllocationRoleFirewall))
+}
+
+func (c *Completion) MachineImageListCompletion(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	return c.listValidImages(pointer.Pointer(models.V1MachineAllocationRoleMachine))
+}
 
 func (c *Completion) ImageListCompletion(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	return c.listValidImages(nil)
+}
+
+func (c *Completion) listValidImages(role *string) ([]string, cobra.ShellCompDirective) {
 	resp, err := c.client.Image().ListImages(image.NewListImagesParams(), nil)
 	if err != nil {
 		return nil, cobra.ShellCompDirectiveError
@@ -31,6 +45,12 @@ func (c *Completion) ImageListCompletion(cmd *cobra.Command, args []string, toCo
 		if i.ID == nil {
 			continue
 		}
+		if role != nil && !slices.Contains(i.Features, *role) {
+			continue
+		}
+		if i.ExpirationDate != nil && time.Now().After(time.Time(*i.ExpirationDate)) {
+			continue
+		}
 		names = append(names, *i.ID)
 	}
 	return names, cobra.ShellCompDirectiveNoFileComp

cmd/firewall.go

@@ -66,7 +66,7 @@ func newFirewallCmd(c *config) *cobra.Command {
 			must(cmd.RegisterFlagCompletionFunc("size", c.comp.SizeListCompletion))
 			must(cmd.RegisterFlagCompletionFunc("project", c.comp.ProjectListCompletion))
 			must(cmd.RegisterFlagCompletionFunc("id", c.comp.FirewallListCompletion))
-			must(cmd.RegisterFlagCompletionFunc("image", c.comp.ImageListCompletion))
+			must(cmd.RegisterFlagCompletionFunc("image", c.comp.FirewallImageListCompletion))
 		},
 	}
 
@@ -134,10 +134,10 @@ func (c firewallCmd) Update(rq any) (*models.V1FirewallResponse, error) {
 }
 
 func (c firewallCmd) Convert(r *models.V1FirewallResponse) (string, *models.V1FirewallCreateRequest, any, error) {
-	if r.ID == nil {
-		return "", nil, nil, fmt.Errorf("id is nil")
-	}
-	return *r.ID, firewallResponseToCreate(r), nil, nil
+	// if r.ID == nil {
+	// 	return "", nil, nil, fmt.Errorf("id is nil")
+	// }
+	return "", firewallResponseToCreate(r), nil, nil
 }
 
 func firewallResponseToCreate(r *models.V1FirewallResponse) *models.V1FirewallCreateRequest {
@@ -169,6 +169,7 @@ func firewallResponseToCreate(r *models.V1FirewallResponse) *models.V1FirewallCr
 		Tags:               r.Tags,
 		UserData:           base64.StdEncoding.EncodeToString([]byte(allocation.UserData)),
 		UUID:               pointer.SafeDeref(r.ID),
+		FirewallRules:      allocation.FirewallRules,
 	}
 }
 
@@ -228,7 +229,7 @@ func parseEgressFlags(inputs []string) ([]*models.V1FirewallEgressRule, error) {
 
 		rule := &models.V1FirewallEgressRule{
 			Protocol: r.protocol,
-			ToCidrs:  r.cidrs,
+			To:       r.cidrs,
 			Ports:    r.ports,
 			Comment:  r.comment,
 		}
@@ -248,10 +249,10 @@ func parseIngressFlags(inputs []string) ([]*models.V1FirewallIngressRule, error)
 		}
 
 		rule := &models.V1FirewallIngressRule{
-			Protocol:  r.protocol,
-			FromCidrs: r.cidrs,
-			Ports:     r.ports,
-			Comment:   r.comment,
+			Protocol: r.protocol,
+			From:     r.cidrs,
+			Ports:    r.ports,
+			Comment:  r.comment,
 		}
 		rules = append(rules, rule)
 	}

cmd/ip.go

@@ -3,7 +3,6 @@ package cmd
 import (
 	"errors"
 	"fmt"
-	"net/http"
 	"strings"
 
 	"github.com/metal-stack/metal-go/api/client/ip"
@@ -127,8 +126,8 @@ func (c ipCmd) Create(rq *ipAllocateRequest) (*models.V1IPResponse, error) {
 	if rq.SpecificIP == "" {
 		resp, err := c.client.IP().AllocateIP(ip.NewAllocateIPParams().WithBody(rq.V1IPAllocateRequest), nil)
 		if err != nil {
-			var r *ip.AllocateIPDefault // FIXME: API should define to return conflict
-			if errors.As(err, &r) && r.Code() == http.StatusUnprocessableEntity {
+			var r *ip.AllocateIPConflict
+			if errors.As(err, &r) {
 				return nil, genericcli.AlreadyExistsError()
 			}
 			return nil, err
@@ -139,8 +138,8 @@ func (c ipCmd) Create(rq *ipAllocateRequest) (*models.V1IPResponse, error) {
 
 	resp, err := c.client.IP().AllocateSpecificIP(ip.NewAllocateSpecificIPParams().WithIP(rq.SpecificIP).WithBody(rq.V1IPAllocateRequest), nil)
 	if err != nil {
-		var r *ip.AllocateSpecificIPDefault // FIXME: API should define to return conflict
-		if errors.As(err, &r) && r.Code() == http.StatusUnprocessableEntity {
+		var r *ip.AllocateSpecificIPConflict
+		if errors.As(err, &r) {
 			return nil, genericcli.AlreadyExistsError()
 		}
 		return nil, err

cmd/ip_test.go

@@ -1,7 +1,6 @@
 package cmd
 
 import (
-	"net/http"
 	"strings"
 	"testing"
 
@@ -94,7 +93,7 @@ IP        ALLOCATION UUID   DESCRIPTION   NAME   NETWORK    PROJECT     TYPE
 			},
 			mocks: &client.MetalMockFns{
 				IP: func(mock *mock.Mock) {
-					mock.On("AllocateSpecificIP", testcommon.MatchIgnoreContext(t, ip.NewAllocateSpecificIPParams().WithBody(ipResponseToCreate(ip1).V1IPAllocateRequest).WithIP(*ip1.Ipaddress)), nil).Return(nil, ip.NewAllocateSpecificIPDefault(http.StatusUnprocessableEntity)).Once()
+					mock.On("AllocateSpecificIP", testcommon.MatchIgnoreContext(t, ip.NewAllocateSpecificIPParams().WithBody(ipResponseToCreate(ip1).V1IPAllocateRequest).WithIP(*ip1.Ipaddress)), nil).Return(nil, ip.NewAllocateSpecificIPConflict()).Once()
 					mock.On("UpdateIP", testcommon.MatchIgnoreContext(t, ip.NewUpdateIPParams().WithBody(ipResponseToUpdate(ip1))), nil).Return(&ip.UpdateIPOK{
 						Payload: ip1,
 					}, nil)

cmd/machine.go

@@ -46,7 +46,7 @@ func (c *machineCmd) listCmdFlags(cmd *cobra.Command, lastEventErrorThresholdDef
 		{flagName: "size", f: c.comp.SizeListCompletion},
 		{flagName: "project", f: c.comp.ProjectListCompletion},
 		{flagName: "id", f: c.comp.MachineListCompletion},
-		{flagName: "image", f: c.comp.ImageListCompletion},
+		{flagName: "image", f: c.comp.MachineImageListCompletion},
 		{flagName: "state", f: cobra.FixedCompletions([]string{
 			// empty does not work:
 			// models.V1FirewallFindRequestStateValueEmpty,
@@ -530,7 +530,7 @@ MODE can be omitted or one of:
 	must(cmd.RegisterFlagCompletionFunc("size", c.comp.SizeListCompletion))
 	must(cmd.RegisterFlagCompletionFunc("project", c.comp.ProjectListCompletion))
 	must(cmd.RegisterFlagCompletionFunc("id", c.comp.MachineListCompletion))
-	must(cmd.RegisterFlagCompletionFunc("image", c.comp.ImageListCompletion))
+	must(cmd.RegisterFlagCompletionFunc("image", c.comp.MachineImageListCompletion))
 	must(cmd.RegisterFlagCompletionFunc("filesystemlayout", c.comp.FilesystemLayoutListCompletion))
 }
 

docs/metalctl_firewall_create.md

@@ -11,7 +11,7 @@ metalctl firewall create [flags]
 ```
       --bulk-output               when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row.
   -d, --description string        Description of the firewall to create. [optional]
-      --egress strings            egress firewall rule to deploy on creation
+      --egress strings            egress firewall rule to deploy on creation format: tcp|udp@cidr#cidr@port#port@comment
   -f, --file string               filename of the create or update request in yaml format, or - for stdin.
                                   
                                   Example:
@@ -29,7 +29,7 @@ metalctl firewall create [flags]
   -H, --hostname string           Hostname of the firewall. [required]
   -I, --id string                 ID of a specific firewall to allocate, if given, size and partition are ignored. Need to be set to reserved (--reserve) state before.
   -i, --image string              OS Image to install. [required]
-      --ingress strings           ingress firewall rule to deploy on creation
+      --ingress strings           ingress firewall rule to deploy on creation format: tcp|udp@cidr#cidr@port#port@comment
       --ips strings               Sets the firewall's IP address. Usage: [--ips[=IPV4-ADDRESS[,IPV4-ADDRESS]...]]...
                                   IPV4-ADDRESS specifies the IPv4 address to add.
                                   It can only be used in conjunction with --networks.

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/go-openapi/runtime v0.27.1
 	github.com/go-openapi/strfmt v0.22.0
 	github.com/google/go-cmp v0.6.0
-	github.com/metal-stack/metal-go v0.26.4-0.20240206074344-b77cd93ebe4d
+	github.com/metal-stack/metal-go v0.28.0
 	github.com/metal-stack/metal-lib v0.14.4
 	github.com/metal-stack/updater v1.2.1
 	github.com/metal-stack/v v1.0.3
@@ -21,7 +21,7 @@ require (
 	github.com/stretchr/testify v1.8.4
 	github.com/undefinedlabs/go-mpatch v1.0.7
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/apimachinery v0.28.4
+	k8s.io/apimachinery v0.29.2
 )
 
 require (
@@ -69,8 +69,8 @@ require (
 	github.com/go-openapi/jsonreference v0.20.4 // indirect
 	github.com/go-openapi/loads v0.21.5 // indirect
 	github.com/go-openapi/spec v0.20.14 // indirect
-	github.com/go-openapi/swag v0.22.9 // indirect
-	github.com/go-openapi/validate v0.23.0 // indirect
+	github.com/go-openapi/swag v0.22.8 // indirect
+	github.com/go-openapi/validate v0.22.6 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/goccy/go-yaml v1.11.3 // indirect
@@ -87,15 +87,15 @@ require (
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hdevalence/ed25519consensus v0.1.0 // indirect
+	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
 	github.com/icza/dyno v0.0.0-20230330125955-09f820a8d9c0 // indirect
 	github.com/illarion/gonotify v1.0.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 // indirect
+	github.com/insomniacslk/dhcp v0.0.0-20240204152450-ca2dc33955c1 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86 // indirect
-	github.com/jsimonetti/rtnetlink v1.4.0 // indirect
+	github.com/jsimonetti/rtnetlink v1.4.1 // indirect
 	github.com/jszwec/csvutil v1.10.0 // indirect
 	github.com/klauspost/compress v1.17.6 // indirect
 	github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a // indirect
@@ -114,7 +114,7 @@ require (
 	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/sdnotify v1.0.0 // indirect
 	github.com/mdlayher/socket v0.5.0 // indirect
-	github.com/metal-stack/security v0.7.1 // indirect
+	github.com/metal-stack/security v0.7.2 // indirect
 	github.com/miekg/dns v1.1.58 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
@@ -123,7 +123,7 @@ require (
 	github.com/pelletier/go-toml/v2 v2.1.1 // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/rivo/uniseg v0.4.6 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/safchain/ethtool v0.3.0 // indirect
 	github.com/sagikazarmark/locafero v0.4.0 // indirect
@@ -154,17 +154,17 @@ require (
 	go.uber.org/zap v1.26.0 // indirect
 	go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
-	golang.org/x/crypto v0.18.0 // indirect
-	golang.org/x/exp v0.0.0-20240205201215-2c58cdc269a3 // indirect
+	golang.org/x/crypto v0.19.0 // indirect
+	golang.org/x/exp v0.0.0-20240213143201-ec583247a57a // indirect
 	golang.org/x/mod v0.15.0 // indirect
-	golang.org/x/net v0.20.0 // indirect
-	golang.org/x/oauth2 v0.16.0 // indirect
+	golang.org/x/net v0.21.0 // indirect
+	golang.org/x/oauth2 v0.17.0 // indirect
 	golang.org/x/sync v0.6.0 // indirect
-	golang.org/x/sys v0.16.0 // indirect
-	golang.org/x/term v0.16.0 // indirect
+	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/term v0.17.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.17.0 // indirect
+	golang.org/x/tools v0.18.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect