Enforce x-kubernetes-validations CEL rules in the aggregated apiserver #2657

Context

cozystack/cozyvalues-gen#24 introduces a ## @immutable annotation that lands as a CEL x-kubernetes-validations: [{rule: "self == oldSelf"}] entry in the chart's values.schema.json and in the openAPISchema field on the matching ApplicationDefinition. #2639 applies it to MariaDB.spec.storageClass as the first user.

The schema annotation is consumed today by:

• The Cozystack UI (feat(console): mark immutable resource fields as read-only in edit forms cozystack-ui#6) — it reads the rule from the schema and renders the field grey-out on edit forms, plus overlays the original value on PUT to act as defence-in-depth.

It is NOT consumed by the cozystack aggregated apiserver. MariaDB is not a native CRD; it is served by pkg/registry/apps/application/rest.go. The Update() method there does not invoke any structural-schema or CEL validation against (newObj, oldObj) — the specSchema built from openAPISchema (lines 100-120) is used only by applySpecDefaults in pkg/registry/apps/application/rest_defaulting.go, never for CEL rules. grep -rn 'XValidation\|cel.NewValidator' pkg/ returns nothing.

Consequence

A kubectl patch or kubectl edit that changes an annotated-as-immutable field is accepted by the apiserver today. The change has no effect on the underlying StatefulSet PVC template (so no data is moved), but the apiserver does not reject the request. The schema's immutability claim is honoured only by clients that opt in to reading x-kubernetes-validations (the UI).

Goal

Wire CEL evaluation into the aggregated apiserver's REST.Update for application-backed resources so that any rule in openAPISchema.x-kubernetes-validations is evaluated against (oldSelf, self) and the update is rejected when the rule returns false.

Suggested approach

• Cache a compiled validator per ApplicationDefinition version (the same place specSchema is cached today).
• In REST.Update, after the existing defaulting + admission, run the validator with the old and new spec; on failure return apierrors.NewInvalid carrying the field and CEL message.
• Cover with a unit test that constructs an Application with an immutable field, submits an update that changes it, and asserts IsInvalid with the expected message.

Out of scope

• The CRD path (BackupJob, Plan, BackupClass etc.) is already enforced by the regular apiextensions apiserver — no change needed there.
• Adding more @immutable annotations to other chart values.yaml files. That is a separate sweep (feat(apps): mark stateful-app storageClass fields as immutable #2639 covers MariaDB only) and is unblocked once enforcement lands.

Related

• feat: add @immutable annotation emitting CEL XValidation rule cozyvalues-gen#24 — annotation generator
• feat(apps): mark stateful-app storageClass fields as immutable #2639 — MariaDB.storageClass annotation (UI-side only until this issue is closed)
• feat(console): mark immutable resource fields as read-only in edit forms cozystack-ui#6 — UI consumer