crd: identityProvider <-> authenticate constraints

Add two CEL constraints on the Pomerium CRD to enforce that if the
identityProvider field is set, the authenticate field must be set as
well (and vice versa).

Logically, this could be expressed as the single constraint
has(self.identityProvider) == has(self.authenticate), but if we split it
into two we can customize the error message depending on the case.

Author: kenjenkins

apis/ingress/v1/pomerium_types.go

@@ -221,6 +221,8 @@ type DownstreamMTLS struct {
 }
 
 // PomeriumSpec defines Pomerium-specific configuration parameters.
+// +kubebuilder:validation:XValidation:rule="!has(self.identityProvider) || has(self.authenticate)",message="authenticate is required if identityProvider is set",reason="FieldValueRequired",fieldPath=".authenticate"
+// +kubebuilder:validation:XValidation:rule="!has(self.authenticate) || has(self.identityProvider)",message="identityProvider is required if authenticate is set",reason="FieldValueRequired",fieldPath=".identityProvider"
 type PomeriumSpec struct {
 	// AccessLogFields sets the <a href="https://www.pomerium.com/docs/reference/access-log-fields">access fields</a> to log.
 	AccessLogFields *[]string `json:"accessLogFields,omitempty"`

config/crd/bases/ingress.pomerium.io_pomerium.yaml

@@ -613,6 +613,15 @@ spec:
             required:
             - secrets
             type: object
+            x-kubernetes-validations:
+            - fieldPath: .authenticate
+              message: authenticate is required if identityProvider is set
+              reason: FieldValueRequired
+              rule: '!has(self.identityProvider) || has(self.authenticate)'
+            - fieldPath: .identityProvider
+              message: identityProvider is required if authenticate is set
+              reason: FieldValueRequired
+              rule: '!has(self.authenticate) || has(self.identityProvider)'
           status:
             description: PomeriumStatus represents configuration and Ingress status.
             properties:

deployment.yaml

@@ -755,6 +755,15 @@ spec:
             required:
             - secrets
             type: object
+            x-kubernetes-validations:
+            - fieldPath: .authenticate
+              message: authenticate is required if identityProvider is set
+              reason: FieldValueRequired
+              rule: '!has(self.identityProvider) || has(self.authenticate)'
+            - fieldPath: .identityProvider
+              message: identityProvider is required if authenticate is set
+              reason: FieldValueRequired
+              rule: '!has(self.authenticate) || has(self.identityProvider)'
           status:
             description: PomeriumStatus represents configuration and Ingress status.
             properties: