@@ -18,6 +18,7 @@ package validation
1818
1919import (
2020 "fmt"
21+ "reflect"
2122 "strings"
2223
2324 genericvalidation "k8s.io/apimachinery/pkg/api/validation"
@@ -107,7 +108,13 @@ func ValidateCustomResourceDefinitionSpec(spec *apiextensions.CustomResourceDefi
107108 if utilfeature .DefaultFeatureGate .Enabled (apiextensionsfeatures .CustomResourceValidation ) {
108109 allErrs = append (allErrs , ValidateCustomResourceDefinitionValidation (spec .Validation , fldPath .Child ("validation" ))... )
109110 } else if spec .Validation != nil {
110- allErrs = append (allErrs , field .Forbidden (fldPath .Child ("validation" ), "disabled by feature-gate" ))
111+ allErrs = append (allErrs , field .Forbidden (fldPath .Child ("validation" ), "disabled by feature-gate CustomResourceValidation" ))
112+ }
113+
114+ if utilfeature .DefaultFeatureGate .Enabled (apiextensionsfeatures .CustomResourceSubResources ) {
115+ allErrs = append (allErrs , ValidateCustomResourceDefinitionSubResources (spec .SubResources , fldPath .Child ("subResources" ))... )
116+ } else if spec .SubResources != nil {
117+ allErrs = append (allErrs , field .Forbidden (fldPath .Child ("subResources" ), "disabled by feature-gate CustomResourceSubresources" ))
111118 }
112119
113120 return allErrs
@@ -182,9 +189,27 @@ func ValidateCustomResourceDefinitionValidation(customResourceValidation *apiext
182189 return allErrs
183190 }
184191
185- if customResourceValidation .OpenAPIV3Schema != nil {
192+ if schema := customResourceValidation .OpenAPIV3Schema ; schema != nil {
193+ // if subresources are enabled, only properties is allowed inside the root schema
194+ if utilfeature .DefaultFeatureGate .Enabled (apiextensionsfeatures .CustomResourceSubResources ) {
195+ v := reflect .ValueOf (schema ).Elem ()
196+ fieldsPresent := 0
197+
198+ for i := 0 ; i < v .NumField (); i ++ {
199+ field := v .Field (i ).Interface ()
200+ if ! reflect .DeepEqual (field , reflect .Zero (reflect .TypeOf (field )).Interface ()) {
201+ fieldsPresent ++
202+ }
203+ }
204+
205+ if fieldsPresent > 1 || (fieldsPresent == 1 && v .FieldByName ("Properties" ).IsNil ()) {
206+ allErrs = append (allErrs , field .Invalid (fldPath .Child ("openAPIV3Schema" ), * schema , fmt .Sprintf ("if subresources for custom resources are enabled, only properties can be used at the root of the schema" )))
207+ return allErrs
208+ }
209+ }
210+
186211 openAPIV3Schema := & specStandardValidatorV3 {}
187- allErrs = append (allErrs , ValidateCustomResourceDefinitionOpenAPISchema (customResourceValidation . OpenAPIV3Schema , fldPath .Child ("openAPIV3Schema" ), openAPIV3Schema )... )
212+ allErrs = append (allErrs , ValidateCustomResourceDefinitionOpenAPISchema (schema , fldPath .Child ("openAPIV3Schema" ), openAPIV3Schema )... )
188213 }
189214
190215 // if validation passed otherwise, make sure we can actually construct a schema validator from this custom resource validation.
@@ -326,3 +351,42 @@ func (v *specStandardValidatorV3) validate(schema *apiextensions.JSONSchemaProps
326351
327352 return allErrs
328353}
354+
355+ // ValidateCustomResourceDefinitionSubResources statically validates
356+ func ValidateCustomResourceDefinitionSubResources (subResources * apiextensions.CustomResourceSubResources , fldPath * field.Path ) field.ErrorList {
357+ allErrs := field.ErrorList {}
358+
359+ if subResources == nil {
360+ return allErrs
361+ }
362+
363+ if subResources .Scale != nil {
364+ if len (subResources .Scale .SpecReplicasPath ) == 0 {
365+ allErrs = append (allErrs , field .Invalid (fldPath .Child ("scale.specReplicasPath" ), subResources .Scale .SpecReplicasPath , "specReplicasPath cannot be empty" ))
366+ }
367+
368+ // should be constrained json path
369+ specReplicasPath := strings .TrimPrefix (subResources .Scale .SpecReplicasPath , "." )
370+ splitSpecReplicasPath := strings .Split (specReplicasPath , "." )
371+ if len (splitSpecReplicasPath ) <= 1 || splitSpecReplicasPath [0 ] != "spec" {
372+ allErrs = append (allErrs , field .Invalid (fldPath .Child ("scale.specReplicasPath" ), subResources .Scale .SpecReplicasPath , "specReplicasPath should be a json path under .spec" ))
373+ }
374+
375+ if len (subResources .Scale .StatusReplicasPath ) == 0 {
376+ allErrs = append (allErrs , field .Invalid (fldPath .Child ("scale.statusReplicasPath" ), subResources .Scale .StatusReplicasPath , "statusReplicasPath cannot be empty" ))
377+ }
378+
379+ // should be constrained json path
380+ statusReplicasPath := strings .TrimPrefix (subResources .Scale .StatusReplicasPath , "." )
381+ splitStatusReplicasPath := strings .Split (statusReplicasPath , "." )
382+ if len (splitStatusReplicasPath ) <= 1 || splitStatusReplicasPath [0 ] != "status" {
383+ allErrs = append (allErrs , field .Invalid (fldPath .Child ("scale.statusReplicasPath" ), subResources .Scale .StatusReplicasPath , "statusReplicasPath should be a json path under .status" ))
384+ }
385+
386+ if subResources .Scale .ScaleGroupVersion != "autoscaling/v1" {
387+ allErrs = append (allErrs , field .Invalid (fldPath .Child ("scale.scaleGroupVersion" ), subResources .Scale .ScaleGroupVersion , "scaleGroupVersion must be autoscaling/v1" ))
388+ }
389+ }
390+
391+ return allErrs
392+ }
0 commit comments