You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/controllers/admission.md
+15-11Lines changed: 15 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,7 +41,7 @@ If your controller [[object]] is a CRD you own, then this is the recommended way
41
41
This requires __Kubernetes >=1.25__ (where the feature is Beta), or Kubernetes >= 1.29 (where the [feature is GA](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md)).
42
42
43
43
44
-
To include validation rules in the schemas you must add `x-kubernetes-validations` entries by [[schemas#overriding-members]] for the necessary types manually (or inject them more manually):
44
+
To include validation rules in the schemas you must add `x-kubernetes-validations` entries by [[schemas#overriding-members]] for the necessary types manually (or use the `x-kube` validation attribute). The manual way (which does not depend on `KubeSchema`):
and this can be attached with a `#[schemars(schema_with = "string_legality)]` field attribute on some `Option<String>` (here). See [#1372](https://github.com/kube-rs/kube/pull/1372/files) too see interactions with errors and a larger struct and other validations.
59
+
this fn can be attached with a `#[schemars(schema_with = "string_legality)]` field attribute on some `Option<String>` (in this example). See [#1372](https://github.com/kube-rs/kube/pull/1372/files) too see interactions with errors and a larger struct and other validations.
60
60
61
61
## `x_kube` validation
62
62
63
-
To simplify the generation of CRD schemas, `kube-rs` offers a dedicated attribute macro accessible via the `KubeSchema` derive. This implementation allows users to declaratively extend each field with validation rules tailored to their specific requirements. Additionally, users have the option to specify additional `x-kubernetes` extension flags, such as the SSA merge strategy, which facilitates the structuring of lists and maps in a specific format.
63
+
To reduce manual schema overriding for CRDs, the alternate [KubeSchema] derive macro can be used instead of [JsonSchema].
64
64
65
-
Here are some examples to showcase these capabilities.
65
+
!!! note "`JsonSchema` vs `KubeSchema`"
66
+
67
+
This macro generates `schemars` `JsonSchema` derive macro for the provided structure. Keep in mind that using the `KubeSchema` derive macro replaces `JsonSchema` derive, and specifying both will cause a conflict.*
68
+
69
+
70
+
This implementation allows users to declaratively extend each field with validation rules (along with other `x-kubernetes` schema properties).
66
71
67
72
### `x_kube(validation = …)` attribute
73
+
This attribute can be used to set one or more `validation` rules on a field. Rules can be created via one of; an explicit [Rule] / a string expression / a (string, reason) string pair;
68
74
69
75
```rust
70
76
#[derive(KubeSchema)]
@@ -79,18 +85,16 @@ pub struct FooSpec {
79
85
}
80
86
```
81
87
82
-
!!! note "`JsonSchema` vs `KubeSchema`"
83
-
84
-
This macro generates `schemars` `JsonSchema` derive macro for the provided structure. Keep in mind that using the `KubeSchema` derive macro replaces `JsonSchema` derive, and specifying both will cause a conflict.*
88
+
The `x_kube(validation = ...)` macro uses the [Rule] structure underneath. This can be constructed using the builder pattern, allowing users to extend the validation with a `message` to distinguish specific validation error and alternative [reasons](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#field-reason) via `reason`, as well as a `field_path` for detailed json path to the invalid field value.
85
89
86
-
The `x_kube(validation = ...)` macro uses a `Rule` structure underneath. A `Rule` can be constructed with builder pattern, allowing users to extend the validation with a `message` to distinguish specific validation error and alternative [reasons](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#field-reason) via `reason`, as well as a `field_path` for detailed json path to the invalid field value.
87
-
88
-
Alternatively, the rule macro can be constructed from a string or a tuple of two strings. The first string represents the validation rule, and the second string is the message assigned to the rule.
90
+
Alternatively, the rule can be constructed implicitly from a string or a tuple of two strings. The first string represents the validation rule, and the second string is the message assigned to the rule.
89
91
90
92
To write CEL expressions consider using the [CEL playground](https://playcel.undistro.io/). There are more examples in the [CRD Validation Rules announcement blog](https://kubernetes.io/blog/2022/09/23/crd-validation-rules-beta/) and under [kubernetes.io crd validation-rules](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules).
91
93
92
94
### `x_kube(merge_strategy = …)` attribute
93
95
96
+
This `x-kubernetes` extension flag controls the [Kubernetes SSA merge strategy](https://kubernetes.io/docs/reference/using-api/server-side-apply/#merge-strategy) from our [MergeStrategy] enum and facilitates the structuring of lists and maps in a specific format.
97
+
94
98
```rust
95
99
#[derive(KubeSchema)]
96
100
pub struct FooSpec {
@@ -104,7 +108,7 @@ pub struct FooItem {
104
108
}
105
109
```
106
110
107
-
This example generates a `x-kubernetes-list-type=map` and `x-kubernetes-list-map-keys=["key"]` attributes with the field. This instructs the API server to treat the underlying list as a map and ensures that `key` field is used as a unique key for the internal map, preventing conflicts during submission of duplicate keys provided by different manager. For more details refer to [merge-strategy](https://kubernetes.io/docs/reference/using-api/server-side-apply/#merge-strategy) in k8s docs.
111
+
This example generates a `x-kubernetes-list-type=map` and `x-kubernetes-list-map-keys=["key"]` attributes with the field. This instructs the API server to treat the underlying list as a map and ensures that `key` field is used as a unique key for the internal map, preventing conflicts on submission of duplicate keys by different managers.
108
112
109
113
## Validation Using Webhooks
110
114
AKA writing an [admission controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/).
0 commit comments