Skip to content

OCPBUGS-32158: Add CEL validation for RegistrySources in Image API #1859

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 24, 2025
Merged

OCPBUGS-32158: Add CEL validation for RegistrySources in Image API #1859

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 102 additions & 0 deletions config/v1/tests/images.config.openshift.io/AAA_ungated.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,105 @@ tests:
apiVersion: config.openshift.io/v1
kind: Image
spec: {}
onUpdate:
- name: Should allow updating other fields with an invalid persisted registrySources in spec
initialCRDPatches:
- op: remove
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/registrySources/x-kubernetes-validations
initial: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
blockedRegistries: ["test"]
allowedRegistries: ["test"]
updated: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
# imageStreamImportMode: Legacy
externalRegistryHostnames: ["test"]
registrySources:
blockedRegistries: ["test"]
allowedRegistries: ["test"]
expected: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
# imageStreamImportMode: Legacy
externalRegistryHostnames: ["test"]
registrySources:
blockedRegistries: ["test"]
allowedRegistries: ["test"]
- name: Should allow removing one of blockedRegistries or allowedRegistries with an invalid persisted registrySources in spec
initialCRDPatches:
- op: remove
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/registrySources/x-kubernetes-validations
initial: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
blockedRegistries: ["test"]
allowedRegistries: ["test"]
updated: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
allowedRegistries: ["test"]
expected: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
allowedRegistries: ["test"]
- name: Should not allow adding another slice entry with an invalid persisted registrySources in spec
initialCRDPatches:
- op: remove
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/registrySources/x-kubernetes-validations
initial: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
blockedRegistries: ["test"]
allowedRegistries: ["test"]
updated: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
blockedRegistries: ["test", "test2"]
allowedRegistries: ["test"]
expectedError: 'Only one of blockedRegistries or allowedRegistries may be set'
- name: Should not allow adding blockedRegistries field when a valid registrySources with allowedRegistries is persisted in spec
initial: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
allowedRegistries: ["test"]
updated: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
allowedRegistries: ["test"]
blockedRegistries: ["test"]
expectedError: 'Only one of blockedRegistries or allowedRegistries may be set'
- name: Should not allow adding allowedRegistries field when a valid registrySources with blockedRegistries is persisted in spec
initial: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
blockedRegistries: ["test"]
updated: |
apiVersion: config.openshift.io/v1
kind: Image
spec:
registrySources:
allowedRegistries: ["test"]
blockedRegistries: ["test"]
expectedError: 'Only one of blockedRegistries or allowedRegistries may be set'
2 changes: 2 additions & 0 deletions config/v1/types_image.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,8 @@ type RegistryLocation struct {
}

// RegistrySources holds cluster-wide information about how to handle the registries config.
//
// +kubebuilder:validation:XValidation:rule="has(self.blockedRegistries) ? !has(self.allowedRegistries) : true",message="Only one of blockedRegistries or allowedRegistries may be set"
type RegistrySources struct {
// insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections.
// +optional
Expand Down
5 changes: 5 additions & 0 deletions .../v1/zz_generated.crd-manifests/0000_10_config-operator_01_images-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down
5 changes: 5 additions & 0 deletions config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_images-Default.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down
5 changes: 5 additions & 0 deletions ...zz_generated.crd-manifests/0000_10_config-operator_01_images-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down
5 changes: 5 additions & 0 deletions ...z_generated.crd-manifests/0000_10_config-operator_01_images-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down
5 changes: 5 additions & 0 deletions ...ig/v1/zz_generated.featuregated-crd-manifests/images.config.openshift.io/AAA_ungated.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down
5 changes: 5 additions & 0 deletions ...enerated.featuregated-crd-manifests/images.config.openshift.io/ImageStreamImportMode.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down
5 changes: 5 additions & 0 deletions payload-manifests/crds/0000_10_config-operator_01_images-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down
5 changes: 5 additions & 0 deletions payload-manifests/crds/0000_10_config-operator_01_images-Default.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down
5 changes: 5 additions & 0 deletions payload-manifests/crds/0000_10_config-operator_01_images-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down
5 changes: 5 additions & 0 deletions payload-manifests/crds/0000_10_config-operator_01_images-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,11 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: Only one of blockedRegistries or allowedRegistries may
be set
rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
: true'
type: object
status:
description: status holds observed values from the cluster. They may not
Expand Down