From 39eaef328b53529a6cf1917f0c2fffe976317a1a Mon Sep 17 00:00:00 2001
From: Matt Anson <matta@stackhpc.com>
Date: Fri, 13 Mar 2026 13:34:32 +0000
Subject: [PATCH] Revert "Block clusters being able to add ngnix-ingress, but
 allow removal (#519)"

This reverts commit 2541c62b76eeeafc19272a745b3e0ae24135f28c.
---
 api/azimuth/serializers.py                    | 39 +++++++++++++++----
 .../tenancy/platforms/kubernetes/form.js      |  3 --
 2 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/api/azimuth/serializers.py b/api/azimuth/serializers.py
index ce13c985..023bab99 100644
--- a/api/azimuth/serializers.py
+++ b/api/azimuth/serializers.py
@@ -824,7 +824,7 @@ def validate(self, data):
 
 class KubernetesClusterValidationMixin:
     def validate(self, data):
-        # Stop ingress being turned on, only allow it to be turned off
+        # If ingress is being enabled, an IP must be specified and that IP must be free
         if (
             # Ingress is being enabled by the change
             data.get("ingress_enabled", False)
@@ -832,13 +832,36 @@ def validate(self, data):
             # Ingress is not currently enabled
             not getattr(self.instance, "ingress_enabled", False)
         ):
-            raise serializers.ValidationError(
-                {
-                    "ingress_enabled": (
-                        "Ingress is deprecated. It cannot be added to new clusters."
-                    ),
-                }
-            )
+            ip_address = data.get("ingress_controller_load_balancer_ip")
+            # No ingress controller IP is given
+            if not ip_address:
+                raise serializers.ValidationError(
+                    {
+                        "ingress_controller_load_balancer_ip": (
+                            "Required when ingress is enabled."
+                        ),
+                    }
+                )
+            # The given IP is not free
+            session = self.context["session"]
+            try:
+                ip = session.find_external_ip_by_ip_address(ip_address)
+            except errors.ObjectNotFoundError as exc:
+                raise serializers.ValidationError(
+                    {
+                        "ingress_controller_load_balancer_ip": str(exc),
+                    }
+                )
+            else:
+                if not ip.available:
+                    raise serializers.ValidationError(
+                        {
+                            "ingress_controller_load_balancer_ip": (
+                                f"{ip_address} is already associated with "
+                                "another platform or machine."
+                            )
+                        }
+                    )
 
         # OCCM does not respect changes to the ingress loadbalancer IP, so disallow it
         if (
diff --git a/ui/src/components/pages/tenancy/platforms/kubernetes/form.js b/ui/src/components/pages/tenancy/platforms/kubernetes/form.js
index 15542828..36e25866 100644
--- a/ui/src/components/pages/tenancy/platforms/kubernetes/form.js
+++ b/ui/src/components/pages/tenancy/platforms/kubernetes/form.js
@@ -646,9 +646,6 @@ export const KubernetesClusterForm = ({
                                 label="Enable Kubernetes Ingress?"
                                 checked={getStateKey('ingress_enabled')}
                                 onChange={setIngressEnabled}
-                                // we only want to allow people to turn off ingress
-                                // no new clusters should be allowed to add ingress
-                                disabled={!getStateKey('ingress_enabled')}
                             />
                         </Field>
                         <Field