Enhance validation rules and constraints in SandboxPool API

- Added maximum length constraints for RuntimeHandler, SlotProfile, WorkerTemplate names, and AppliedSlot profile.
- Updated immutability validation rules for SlotProfiles and WorkerTemplates to ensure consistency during updates.
- Enhanced CRD definitions to reflect new validation requirements for resource specifications and limits.
- Improved overall API structure for better resource management and validation compliance.

Author: FAUST-BENCHOU

api/v1alpha1/sandboxpool_types.go

@@ -14,6 +14,7 @@ type CRIRuntimeConfig struct {
 	// containerd. It is an opaque string (for example "runsc" or "runc");
 	// SandboxFleet does not interpret runtime-specific values.
 	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
 	RuntimeHandler string `json:"runtimeHandler"`
 }
 
@@ -29,43 +30,54 @@ type RuntimeConfig struct {
 // SlotProfile is a named, fixed resource specification for Slots.
 type SlotProfile struct {
 	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
 	Name string `json:"name"`
 
 	// Resources is the per-Slot budget. Immutable after the Profile is created.
+	// Resource changes are rejected by Worker ApplySlots for existing Slot IDs.
 	Resources corev1.ResourceRequirements `json:"resources"`
 }
 
 // SlotGroup declares how many Slots of one Profile each Worker of a Template has.
 type SlotGroup struct {
 	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
 	Profile string `json:"profile"`
 
 	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=256
 	Count int32 `json:"count"`
 }
 
 // WorkerTemplate defines a homogeneous set of Worker Pods and their Slot layout.
 type WorkerTemplate struct {
 	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
 	Name string `json:"name"`
 
 	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=1000
 	Replicas int32 `json:"replicas"`
 
 	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=32
 	Slots []SlotGroup `json:"slots"`
 }
 
+// Runtime and profile/template names are immutable. Profile resources are enforced
+// at apply time (existing Slot IDs cannot change resources).
 // +kubebuilder:validation:XValidation:rule="self.runtime == oldSelf.runtime",message="runtime is immutable"
-// +kubebuilder:validation:XValidation:rule="oldSelf.slotProfiles.all(o, self.slotProfiles.exists(p, p.name == o.name && p.resources == o.resources))",message="slotProfile names and resources are immutable"
-// +kubebuilder:validation:XValidation:rule="oldSelf.workerTemplates.all(o, self.workerTemplates.exists(t, t.name == o.name))",message="workerTemplate names are immutable"
+// +kubebuilder:validation:XValidation:rule="size(self.slotProfiles) == size(oldSelf.slotProfiles) && oldSelf.slotProfiles.all(o, self.slotProfiles.exists(p, p.name == o.name))",message="slotProfile names are immutable"
+// +kubebuilder:validation:XValidation:rule="size(self.workerTemplates) == size(oldSelf.workerTemplates) && oldSelf.workerTemplates.all(o, self.workerTemplates.exists(t, t.name == o.name))",message="workerTemplate names are immutable"
 type SandboxPoolSpec struct {
 	Runtime RuntimeConfig `json:"runtime"`
 
 	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=32
 	SlotProfiles []SlotProfile `json:"slotProfiles"`
 
 	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=32
 	WorkerTemplates []WorkerTemplate `json:"workerTemplates"`
 }
 
@@ -77,13 +89,15 @@ type WorkerTemplateStatus struct {
 
 	// AppliedSlots is the Slot layout currently applied for this Template's Workers.
 	// +optional
+	// +kubebuilder:validation:MaxItems=256
 	AppliedSlots []AppliedSlot `json:"appliedSlots,omitempty"`
 }
 
 // AppliedSlot is one Slot in a Template's applied topology.
 type AppliedSlot struct {
 	ID int32 `json:"id"`
 	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
 	Profile string `json:"profile"`
 }
 

config/crd/sandboxpools.yaml

@@ -41,9 +41,9 @@ spec:
               x-kubernetes-validations:
                 - rule: "self.runtime == oldSelf.runtime"
                   message: runtime is immutable
-                - rule: "oldSelf.slotProfiles.all(o, self.slotProfiles.exists(p, p.name == o.name && p.resources == o.resources))"
-                  message: slotProfile names and resources are immutable
-                - rule: "oldSelf.workerTemplates.all(o, self.workerTemplates.exists(t, t.name == o.name))"
+                - rule: "size(self.slotProfiles) == size(oldSelf.slotProfiles) && oldSelf.slotProfiles.all(o, self.slotProfiles.exists(p, p.name == o.name))"
+                  message: slotProfile names are immutable
+                - rule: "size(self.workerTemplates) == size(oldSelf.workerTemplates) && oldSelf.workerTemplates.all(o, self.workerTemplates.exists(t, t.name == o.name))"
                   message: workerTemplate names are immutable
               properties:
                 runtime:
@@ -63,12 +63,14 @@ spec:
                         runtimeHandler:
                           type: string
                           minLength: 1
+                          maxLength: 253
                   x-kubernetes-validations:
                     - rule: "self.backend != 'cri' || has(self.cri)"
                       message: cri configuration is required for the cri backend
                 slotProfiles:
                   type: array
                   minItems: 1
+                  maxItems: 32
                   items:
                     type: object
                     required:
@@ -78,6 +80,7 @@ spec:
                       name:
                         type: string
                         minLength: 1
+                        maxLength: 63
                       resources:
                         type: object
                         properties:
@@ -98,6 +101,7 @@ spec:
                 workerTemplates:
                   type: array
                   minItems: 1
+                  maxItems: 32
                   items:
                     type: object
                     required:
@@ -108,13 +112,16 @@ spec:
                       name:
                         type: string
                         minLength: 1
+                        maxLength: 63
                       replicas:
                         type: integer
                         format: int32
                         minimum: 0
+                        maximum: 1000
                       slots:
                         type: array
                         minItems: 1
+                        maxItems: 32
                         items:
                           type: object
                           required:
@@ -124,10 +131,12 @@ spec:
                             profile:
                               type: string
                               minLength: 1
+                              maxLength: 63
                             count:
                               type: integer
                               format: int32
                               minimum: 1
+                              maximum: 256
             status:
               type: object
               properties:
@@ -161,6 +170,7 @@ spec:
                         format: int32
                       appliedSlots:
                         type: array
+                        maxItems: 256
                         items:
                           type: object
                           required:
@@ -173,6 +183,7 @@ spec:
                             profile:
                               type: string
                               minLength: 1
+                              maxLength: 63
                 profiles:
                   type: array
                   items: