Skip to content

feat(cozystack-api): Add validation webhook for instanceType and instanceProfile #1941

New issue
New issue
Open
Open
feat(cozystack-api): Add validation webhook for instanceType and instanceProfile#1941
Labels
area/apiIssues or PRs related to the cozystack-api aggregated API serverarea/virtualizationIssues or PRs related to virtualization (kubevirt, cdi, vmi, vm-import)kind/featureCategorizes issue or PR as related to a new featurelifecycle/frozenIndicates that an issue or PR should not be auto-closed due to stalenesspriority/backlogGeneral backlog priority. Lower than priority/important-longtermtriage/acceptedIndicates an issue is ready to be actively worked on

Description

@lexfrei
Aleksei Sviridkin (lexfrei)
opened on Jan 30, 2026

Summary

Move validation of instanceType and instanceProfile values from Helm lookup function to a validating admission webhook in cozystack-api.

Background

Currently, VM-related charts (virtual-machine, vm-instance, kubernetes) use Helm's lookup function to validate that specified instanceType and instanceProfile exist in the cluster:

{{- if and .Values.instanceType (not (lookup "instancetype.kubevirt.io/v1beta1" "VirtualMachineClusterInstancetype" "" .Values.instanceType)) }}
{{-   fail (printf "Specified instanceType does not exist in the cluster: %s" .Values.instanceType) }}
{{- end }}

Problems with current approach

  1. GitOps incompatibility: lookup returns nil with helm template, breaking ArgoCD and similar tools
  2. Testing difficulty: Cannot test charts with helm template --dry-run
  3. Inconsistent UX: Validation happens at render time, not at API level
  4. Code duplication: Same validation logic repeated in multiple charts

Proposed Solution

Add a validating admission webhook in cozystack-api that:

  1. Intercepts HelmRelease resources for VM-related applications
  2. Validates that referenced instanceType exists as VirtualMachineClusterInstancetype
  3. Validates that referenced instanceProfile exists as VirtualMachineClusterPreference
  4. Returns clear error messages on validation failure

Affected charts

  • packages/apps/virtual-machine
  • packages/apps/vm-instance
  • packages/apps/kubernetes (for node groups)

Benefits

  • Works with any GitOps tool (ArgoCD, FluxCD, etc.)
  • Testable with helm template
  • Centralized validation logic
  • Better error messages at API level
  • Consistent with Kubernetes admission patterns

Implementation Notes

  • cozystack-api already has webhook infrastructure (internal/lineagecontrollerwebhook/)
  • Could be implemented as a new validating webhook or extension to existing infrastructure
  • Should validate on CREATE and UPDATE operations

Related

  • Research on Helm lookup alternatives for GitOps compatibility

Activity

  1. dosubot
    added
    kind/featureCategorizes issue or PR as related to a new feature
    on Jan 30, 2026

  2. dosubot commented on May 1, 2026

    @dosubot
    dosubotBot
    on May 1, 2026 – with DosuBot

    Hi, Aleksei Sviridkin (@lexfrei). I'm Dosu, and I'm helping the cozystack team manage their backlog and am marking this issue as stale.

    Issue Summary:

    • You proposed adding a validating admission webhook in cozystack-api to validate instanceType and instanceProfile for VM-related Helm charts.
    • This would replace the current Helm lookup function to improve GitOps compatibility and allow testing with helm template.
    • The webhook aims to centralize validation logic and provide clearer API-level error messages.
    • It would validate HelmRelease resources on CREATE and UPDATE operations.
    • There has been no further activity or comments on this proposal.

    Next Steps:

    • Please let us know if this issue is still relevant to the latest version of the cozystack repository by commenting here.
    • If we do not hear back within 7 days, this issue will be automatically closed.

    Thank you for your understanding and contribution!

  3. dosubot
    added
    stale
    on May 1, 2026
  4. github-actions
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    and removed
    stale
    on May 4, 2026
  5. dosubot
    added
    stale
    on Aug 3, 2026
  6. github-actions
    added
    triage/needs-triageIndicates an issue needs triage by a maintainer
    and removed
    stale
    on Aug 10, 2026
  7. Aleksei Sviridkin (lexfrei)
    added
    area/apiIssues or PRs related to the cozystack-api aggregated API server
    area/virtualizationIssues or PRs related to virtualization (kubevirt, cdi, vmi, vm-import)
    triage/acceptedIndicates an issue is ready to be actively worked on
    priority/backlogGeneral backlog priority. Lower than priority/important-longterm
    lifecycle/frozenIndicates that an issue or PR should not be auto-closed due to staleness
    and removed
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    triage/needs-triageIndicates an issue needs triage by a maintainer
    on Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/apiIssues or PRs related to the cozystack-api aggregated API serverarea/virtualizationIssues or PRs related to virtualization (kubevirt, cdi, vmi, vm-import)kind/featureCategorizes issue or PR as related to a new featurelifecycle/frozenIndicates that an issue or PR should not be auto-closed due to stalenesspriority/backlogGeneral backlog priority. Lower than priority/important-longtermtriage/acceptedIndicates an issue is ready to be actively worked on

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions