fix(waf): ignore waf acl set to empty string

Author: zac-nixon

pkg/ingress/model_build_load_balancer_addons.go

@@ -2,6 +2,7 @@ package ingress
 
 import (
 	"context"
+
 	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"sigs.k8s.io/aws-load-balancer-controller/v3/pkg/annotations"
@@ -60,7 +61,8 @@ func (t *defaultModelBuildTask) buildWAFv2WebACLAssociation(ctx context.Context,
 			}
 
 			rawWebACLARN := ""
-			if exists := t.annotationParser.ParseStringAnnotation(annotations.IngressSuffixWAFv2ACLARN, &rawWebACLARN, member.Ing.Annotations); !exists {
+			exists := t.annotationParser.ParseStringAnnotation(annotations.IngressSuffixWAFv2ACLARN, &rawWebACLARN, member.Ing.Annotations)
+			if !exists || rawWebACLARN == "" {
 				continue
 			}
 			explicitWebACLARNs.Insert(rawWebACLARN)

pkg/ingress/model_build_load_balancer_addons_test.go

@@ -69,6 +69,31 @@ func Test_defaultModelBuildTask_buildWAFv2WebACLAssociation(t *testing.T) {
 			want:    nil,
 			wantErr: assert.NoError,
 		},
+		{
+			name: " wafv2-acl-arn set to empty string",
+			fields: fields{
+				ingGroup: Group{
+					Members: []ClassifiedIngress{
+						{
+							Ing: &networking.Ingress{
+								ObjectMeta: metav1.ObjectMeta{
+									Namespace: "awesome-ns",
+									Name:      "awesome-ing-0",
+									Annotations: map[string]string{
+										"alb.ingress.kubernetes.io/wafv2-acl-arn": "",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			args: args{
+				lbARN: core.LiteralStringToken("awesome-lb-arn"),
+			},
+			want:    nil,
+			wantErr: assert.NoError,
+		},
 		{
 			name: "when all ingresses have wafv2-acl-arn annotation set to wafv2-arn-1",
 			fields: fields{