GT-452 Improve master endpoint validation (#1339)

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## [master](https://github.com/arangodb/kube-arangodb/tree/master) (N/A)
 - (Improvement) Block traffic on the services if there is more than 1 active leader in ActiveFailover mode
+- (Improvement) Improve master endpoint validation.
 
 ## [1.2.30](https://github.com/arangodb/kube-arangodb/tree/1.2.30) (2023-06-16)
 - (Feature) AgencyCache Interface

pkg/apis/deployment/v1/sync_external_access_spec.go

@@ -63,8 +63,15 @@ func (s SyncExternalAccessSpec) Validate() error {
 		return errors.WithStack(err)
 	}
 	for _, ep := range s.MasterEndpoint {
-		if _, err := url.Parse(ep); err != nil {
+		if u, err := url.Parse(ep); err != nil {
 			return errors.WithStack(errors.Newf("Failed to parse master endpoint '%s': %s", ep, err))
+		} else {
+			if u.Scheme != "http" && u.Scheme != "https" {
+				return errors.WithStack(errors.Newf("Invalid scheme '%s' in master endpoint '%s'", u.Scheme, ep))
+			}
+			if u.Host == "" {
+				return errors.WithStack(errors.Newf("Missing host in master endpoint '%s'", ep))
+			}
 		}
 	}
 	for _, name := range s.AccessPackageSecretNames {

pkg/apis/deployment/v1/sync_spec_test.go

@@ -102,3 +102,37 @@ func TestSyncSpecResetImmutableFields(t *testing.T) {
 		assert.Equal(t, test.Expected, test.Target)
 	}
 }
+
+func TestSyncSpecMasterEndpointValidate(t *testing.T) {
+	auth := SyncAuthenticationSpec{
+		JWTSecretName:      util.NewType[string]("foo"),
+		ClientCASecretName: util.NewType[string]("foo-client"),
+	}
+	tls := TLSSpec{
+		CASecretName: util.NewType[string]("None"),
+	}
+	t.Run("Valid MasterEndpoint", func(t *testing.T) {
+		err := SyncSpec{
+			Authentication: auth,
+			TLS:            tls,
+			ExternalAccess: SyncExternalAccessSpec{
+				MasterEndpoint: []string{"https://arangodb.xyz:8629"},
+			},
+			Enabled: util.NewType[bool](true),
+		}.Validate(DeploymentModeCluster)
+		assert.Nil(t, err)
+	})
+
+	t.Run("Invalid MasterEndpoint without protocol", func(t *testing.T) {
+		err := SyncSpec{
+			Authentication: auth,
+			TLS:            tls,
+			ExternalAccess: SyncExternalAccessSpec{
+				MasterEndpoint: []string{"example.com:8629"},
+			},
+			Enabled: util.NewType[bool](true),
+		}.Validate(DeploymentModeCluster)
+		assert.Error(t, err)
+		assert.Equal(t, "Invalid scheme 'example.com' in master endpoint 'example.com:8629'", err.Error())
+	})
+}