[Add] CEL rules for validating App and PackageInstall Spec

This PR: - Adds KB marker to ensure that either spec.ServiceAccount or spec.Cluster is present in App and PackageInstall CR. - Bumps controller-tools to 0.10.0 to support CEL based validation marker. That is the latest version compatible with the k8s release the project is currently at. Signed-off-by: Varsha Prasad Narsing <[email protected]>
carvel-dev · Oct 30, 2023 · a1cb874 · a1cb874
1 parent 5b1294b
commit a1cb874
Show file tree

Hide file tree

Showing 46 changed files with 725 additions and 214 deletions.
diff --git a/config/config/crds.yml b/config/config/crds.yml
@@ -690,6 +690,9 @@ spec:
                           type: object
                         type: array
                     type: object
+                    x-kubernetes-validations:
+                    - message: Expected service account or cluster.
+                      rule: has(self.serviceAccountName) || has(self.cluster)
                 required:
                 - spec
                 type: object
@@ -1306,6 +1309,9 @@ spec:
                   type: object
                 type: array
             type: object
+            x-kubernetes-validations:
+            - message: Expected service account or cluster.
+              rule: has(self.serviceAccountName) || has(self.cluster)
           status:
             properties:
               conditions:
@@ -1555,6 +1561,9 @@ spec:
                   type: object
                 type: array
             type: object
+            x-kubernetes-validations:
+            - message: Expected service account or cluster.
+              rule: has(self.serviceAccountName) || has(self.cluster)
           status:
             properties:
               conditions:

diff --git a/go.mod b/go.mod
@@ -22,7 +22,7 @@ require (
 	k8s.io/kube-aggregator v0.22.17
 	k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1
 	sigs.k8s.io/controller-runtime v0.13.1
-	sigs.k8s.io/controller-tools v0.7.0
+	sigs.k8s.io/controller-tools v0.10.0
 	sigs.k8s.io/yaml v1.3.0
 )
 
@@ -61,7 +61,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.19.6 // indirect
 	github.com/go-openapi/swag v0.19.15 // indirect
-	github.com/gobuffalo/flect v0.2.3 // indirect
+	github.com/gobuffalo/flect v0.2.5 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect

diff --git a/go.sum b/go.sum
diff --git a/pkg/apis/kappctrl/v1alpha1/generated.proto b/pkg/apis/kappctrl/v1alpha1/generated.proto
diff --git a/pkg/apis/kappctrl/v1alpha1/types.go b/pkg/apis/kappctrl/v1alpha1/types.go
@@ -44,6 +44,7 @@ type AppList struct {
 }
 
 // +k8s:openapi-gen=true
+// +kubebuilder:validation:XValidation:rule="has(self.serviceAccountName) || has(self.cluster)", message="Expected service account or cluster."
 type AppSpec struct {
 	// Specifies that app should be deployed authenticated via
 	// given service account, found in this namespace (optional; v0.6.0+)

diff --git a/pkg/apis/packaging/v1alpha1/package_install.go b/pkg/apis/packaging/v1alpha1/package_install.go
@@ -43,6 +43,7 @@ type PackageInstallList struct {
 	Items []PackageInstall `json:"items"`
 }
 
+// +kubebuilder:validation:XValidation:rule="has(self.serviceAccountName) || has(self.cluster)", message="Expected service account or cluster."
 type PackageInstallSpec struct {
 	// Specifies service account that will be used to install underlying package contents
 	// +optional

diff --git a/vendor/github.com/gobuffalo/flect/camelize.go b/vendor/github.com/gobuffalo/flect/camelize.go
diff --git a/vendor/github.com/gobuffalo/flect/pascalize.go b/vendor/github.com/gobuffalo/flect/pascalize.go
diff --git a/vendor/github.com/gobuffalo/flect/plural_rules.go b/vendor/github.com/gobuffalo/flect/plural_rules.go
diff --git a/vendor/github.com/gobuffalo/flect/singular_rules.go b/vendor/github.com/gobuffalo/flect/singular_rules.go
diff --git a/vendor/modules.txt b/vendor/modules.txt
@@ -79,7 +79,7 @@ github.com/go-openapi/jsonreference
 # github.com/go-openapi/swag v0.19.15
 ## explicit; go 1.11
 github.com/go-openapi/swag
-# github.com/gobuffalo/flect v0.2.3
+# github.com/gobuffalo/flect v0.2.5
 ## explicit; go 1.13
 github.com/gobuffalo/flect
 # github.com/gogo/protobuf v1.3.2
@@ -1248,8 +1248,8 @@ sigs.k8s.io/controller-runtime/pkg/source/internal
 sigs.k8s.io/controller-runtime/pkg/webhook
 sigs.k8s.io/controller-runtime/pkg/webhook/admission
 sigs.k8s.io/controller-runtime/pkg/webhook/internal/metrics
-# sigs.k8s.io/controller-tools v0.7.0
-## explicit; go 1.16
+# sigs.k8s.io/controller-tools v0.10.0
+## explicit; go 1.19
 sigs.k8s.io/controller-tools/cmd/controller-gen
 sigs.k8s.io/controller-tools/pkg/crd
 sigs.k8s.io/controller-tools/pkg/crd/markers

diff --git a/vendor/sigs.k8s.io/controller-tools/cmd/controller-gen/main.go b/vendor/sigs.k8s.io/controller-tools/cmd/controller-gen/main.go
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/doc.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/doc.go
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/flatten.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/flatten.go
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/gen.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/gen.go
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/known_types.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/known_types.go
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/doc.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/doc.go