validaiton with featuregate

Signed-off-by: Qi Wang <[email protected]>
openshift · Nov 18, 2024 · 3f7784d · 3f7784d
1 parent 0c69e82
commit 3f7784d
Show file tree

Hide file tree

Showing 23 changed files with 101 additions and 76 deletions.
diff --git a/...ig/v1alpha1/tests/clusterimagepolicies.config.openshift.io/SigstoreImageVerification.yaml b/...ig/v1alpha1/tests/clusterimagepolicies.config.openshift.io/SigstoreImageVerification.yaml
@@ -450,30 +450,4 @@ tests:
               policyType: PublicKey
               publicKey:
                 keyData: Zm9vIGJhcg==
-    - name: Should be able to create a minimal ClusterImagePolicy with policyType PKI
-      initial: |
-        apiVersion: config.openshift.io/v1alpha1
-        kind: ClusterImagePolicy
-        spec:
-          scopes:
-          - example.com
-          policy:
-            rootOfTrust:
-              policyType: PKI
-              pki:
-                caRootsData: Zm9vIGJhcg==
-                pkiCertificateSubject:
-                  email: [email protected]
-      expected: |
-        apiVersion: config.openshift.io/v1alpha1
-        kind: ClusterImagePolicy
-        spec:
-          scopes:
-          - example.com
-          policy:
-            rootOfTrust:
-              policyType: PKI
-              pki:
-                caRootsData: Zm9vIGJhcg==
-                pkiCertificateSubject:
-                  email: [email protected]
+
diff --git a/config/v1alpha1/tests/imagepolicies.config.openshift.io/SigstoreImageVerification.yaml b/config/v1alpha1/tests/imagepolicies.config.openshift.io/SigstoreImageVerification.yaml
@@ -450,30 +450,4 @@ tests:
               policyType: PublicKey
               publicKey:
                 keyData: Zm9vIGJhcg==
-    - name: Should be able to create a minimal ImagePolicy with policyType PKI
-      initial: |
-        apiVersion: config.openshift.io/v1alpha1
-        kind: ImagePolicy
-        spec:
-          scopes:
-          - example.com
-          policy:
-            rootOfTrust:
-              policyType: PKI
-              pki:
-                caRootsData: Zm9vIGJhcg==
-                pkiCertificateSubject:
-                  email: [email protected]
-      expected: |
-        apiVersion: config.openshift.io/v1alpha1
-        kind: ImagePolicy
-        spec:
-          scopes:
-          - example.com
-          policy:
-            rootOfTrust:
-              policyType: PKI
-              pki:
-                caRootsData: Zm9vIGJhcg==
-                pkiCertificateSubject:
-                  email: [email protected]
+
diff --git a/config/v1alpha1/tests/imagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml b/config/v1alpha1/tests/imagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml
@@ -30,4 +30,45 @@ tests:
               pki:
                 caRootsData: Zm9vIGJhcg==
                 pkiCertificateSubject:
-                  email: [email protected]
+                  email: [email protected]
+    - name: Should not allow policyType PKI but not set pki
+      initial: |
+        apiVersion: config.openshift.io/v1alpha1
+        kind: ImagePolicy
+        spec:
+          scopes:
+          - example.com
+          policy:
+            rootOfTrust:
+              policyType: PKI
+      expectedError: "spec.policy.rootOfTrust: Invalid value: \"object\": pki is required when policyType is PKI, and forbidden otherwise"
+    - name: Should not allow pkiCertificateSubject invalid email
+      initial: |
+        apiVersion: config.openshift.io/v1alpha1
+        kind: ImagePolicy
+        spec:
+          scopes:
+          - example.com
+          policy:
+            rootOfTrust:
+              policyType: PKI
+              pki:
+                caRootsData: Zm9vIGJhcg==
+                pkiCertificateSubject:
+                  email: invalid-email
+      expectedError: "spec.policy.rootOfTrust.pki.pkiCertificateSubject.email: Invalid value: \"string\": invalid email address in pkiCertificateSubject"
+    - name: Should not allow pkiCertificateSubject invalid hostname
+      initial: |
+        apiVersion: config.openshift.io/v1alpha1
+        kind: ImagePolicy
+        spec:
+          scopes:
+          - example.com
+          policy:
+            rootOfTrust:
+              policyType: PKI
+              pki:
+                caRootsData: Zm9vIGJhcg==
+                pkiCertificateSubject:
+                  hostname: invaild
+      expectedError: "spec.policy.rootOfTrust.pki.pkiCertificateSubject.hostname: Invalid value: \"string\": invalid hostname in pkiCertificateSubject"
diff --git a/config/v1alpha1/types_image_policy.go b/config/v1alpha1/types_image_policy.go
@@ -73,6 +73,7 @@ type Policy struct {
 // +union
 // +kubebuilder:validation:XValidation:rule="has(self.policyType) && self.policyType == 'PublicKey' ? has(self.publicKey) : !has(self.publicKey)",message="publicKey is required when policyType is PublicKey, and forbidden otherwise"
 // +kubebuilder:validation:XValidation:rule="has(self.policyType) && self.policyType == 'FulcioCAWithRekor' ? has(self.fulcioCAWithRekor) : !has(self.fulcioCAWithRekor)",message="fulcioCAWithRekor is required when policyType is FulcioCAWithRekor, and forbidden otherwise"
+// +openshift:validation:FeatureGateAwareXValidation:featureGate=SigstoreImageVerificationPKI,rule="has(self.policyType) && self.policyType == 'PKI' ? has(self.pki) : !has(self.pki)",message="pki is required when policyType is PKI, and forbidden otherwise"
 type PolicyRootOfTrust struct {
 	// policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust.
 	// "PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification.
@@ -95,7 +96,8 @@ type PolicyRootOfTrust struct {
 	PKI *PKI `json:"pki,omitempty"`
 }
 
-// +kubebuilder:validation:Enum=PublicKey;FulcioCAWithRekor;PKI
+// +openshift:validation:FeatureGateAwareEnum:featureGate=SigstoreImageVerification,enum=PublicKey;FulcioCAWithRekor
+// +openshift:validation:FeatureGateAwareEnum:featureGate=SigstoreImageVerificationPKI,enum=PublicKey;FulcioCAWithRekor;PKI
 type PolicyType string
 
 const (
@@ -176,7 +178,7 @@ type PKICertificateSubject struct {
 	// +optional
 	// +kubebuilder:validation:XValidation:rule=`self.matches('^\\S+@\\S+$')`,message="invalid email address in pkiCertificateSubject"
 	Email string `json:"email,omitempty"`
-	// Hostname specifies the expected hostname imposed on the subject to which the certificate was issued.
+	// hostname specifies the expected hostname imposed on the subject to which the certificate was issued.
 	// +optional
 	// +kubebuilder:validation:XValidation:rule=`self.matches('^(\\*\\.)?([a-zA-Z0-9-]+\\.)*[a-zA-Z0-9-]+\\.[a-zA-Z]{2,}$')`,message="invalid hostname in pkiCertificateSubject"
 	Hostname string `json:"hostname,omitempty"`

diff --git a/...ed.crd-manifests/0000_10_config-operator_01_clusterimagepolicies-CustomNoUpgrade.crd.yaml b/...ed.crd-manifests/0000_10_config-operator_01_clusterimagepolicies-CustomNoUpgrade.crd.yaml
@@ -135,7 +135,7 @@ spec:
                                 - message: invalid email address in pkiCertificateSubject
                                   rule: self.matches('^\\S+@\\S+$')
                               hostname:
-                                description: Hostname specifies the expected hostname
+                                description: hostname specifies the expected hostname
                                   imposed on the subject to which the certificate
                                   was issued.
                                 type: string
@@ -187,6 +187,10 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''

diff --git a/...rd-manifests/0000_10_config-operator_01_clusterimagepolicies-DevPreviewNoUpgrade.crd.yaml b/...rd-manifests/0000_10_config-operator_01_clusterimagepolicies-DevPreviewNoUpgrade.crd.yaml
@@ -135,7 +135,7 @@ spec:
                                 - message: invalid email address in pkiCertificateSubject
                                   rule: self.matches('^\\S+@\\S+$')
                               hostname:
-                                description: Hostname specifies the expected hostname
+                                description: hostname specifies the expected hostname
                                   imposed on the subject to which the certificate
                                   was issued.
                                 type: string
@@ -187,6 +187,10 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''

diff --git a/...d-manifests/0000_10_config-operator_01_clusterimagepolicies-TechPreviewNoUpgrade.crd.yaml b/...d-manifests/0000_10_config-operator_01_clusterimagepolicies-TechPreviewNoUpgrade.crd.yaml
@@ -111,7 +111,6 @@ spec:
                         enum:
                         - PublicKey
                         - FulcioCAWithRekor
-                        - PKI
                         type: string
                       publicKey:
                         description: publicKey defines the root of trust based on

diff --git a/...generated.crd-manifests/0000_10_config-operator_01_imagepolicies-CustomNoUpgrade.crd.yaml b/...generated.crd-manifests/0000_10_config-operator_01_imagepolicies-CustomNoUpgrade.crd.yaml
@@ -135,7 +135,7 @@ spec:
                                 - message: invalid email address in pkiCertificateSubject
                                   rule: self.matches('^\\S+@\\S+$')
                               hostname:
-                                description: Hostname specifies the expected hostname
+                                description: hostname specifies the expected hostname
                                   imposed on the subject to which the certificate
                                   was issued.
                                 type: string
@@ -187,6 +187,10 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''

diff --git a/...rated.crd-manifests/0000_10_config-operator_01_imagepolicies-DevPreviewNoUpgrade.crd.yaml b/...rated.crd-manifests/0000_10_config-operator_01_imagepolicies-DevPreviewNoUpgrade.crd.yaml
@@ -135,7 +135,7 @@ spec:
                                 - message: invalid email address in pkiCertificateSubject
                                   rule: self.matches('^\\S+@\\S+$')
                               hostname:
-                                description: Hostname specifies the expected hostname
+                                description: hostname specifies the expected hostname
                                   imposed on the subject to which the certificate
                                   was issued.
                                 type: string
@@ -187,6 +187,10 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''

diff --git a/...ated.crd-manifests/0000_10_config-operator_01_imagepolicies-TechPreviewNoUpgrade.crd.yaml b/...ated.crd-manifests/0000_10_config-operator_01_imagepolicies-TechPreviewNoUpgrade.crd.yaml
@@ -111,7 +111,6 @@ spec:
                         enum:
                         - PublicKey
                         - FulcioCAWithRekor
-                        - PKI
                         type: string
                       publicKey:
                         description: publicKey defines the root of trust based on

diff --git a/...ted-crd-manifests/clusterimagepolicies.config.openshift.io/SigstoreImageVerification.yaml b/...ted-crd-manifests/clusterimagepolicies.config.openshift.io/SigstoreImageVerification.yaml
@@ -111,7 +111,6 @@ spec:
                         enum:
                         - PublicKey
                         - FulcioCAWithRekor
-                        - PKI
                         type: string
                       publicKey:
                         description: publicKey defines the root of trust based on

diff --git a/...-crd-manifests/clusterimagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml b/...-crd-manifests/clusterimagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml
@@ -135,7 +135,7 @@ spec:
                                 - message: invalid email address in pkiCertificateSubject
                                   rule: self.matches('^\\S+@\\S+$')
                               hostname:
-                                description: Hostname specifies the expected hostname
+                                description: hostname specifies the expected hostname
                                   imposed on the subject to which the certificate
                                   was issued.
                                 type: string
@@ -187,6 +187,10 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''

diff --git a/...aturegated-crd-manifests/imagepolicies.config.openshift.io/SigstoreImageVerification.yaml b/...aturegated-crd-manifests/imagepolicies.config.openshift.io/SigstoreImageVerification.yaml
@@ -111,7 +111,6 @@ spec:
                         enum:
                         - PublicKey
                         - FulcioCAWithRekor
-                        - PKI
                         type: string
                       publicKey:
                         description: publicKey defines the root of trust based on

diff --git a/...regated-crd-manifests/imagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml b/...regated-crd-manifests/imagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml
@@ -135,7 +135,7 @@ spec:
                                 - message: invalid email address in pkiCertificateSubject
                                   rule: self.matches('^\\S+@\\S+$')
                               hostname:
-                                description: Hostname specifies the expected hostname
+                                description: hostname specifies the expected hostname
                                   imposed on the subject to which the certificate
                                   was issued.
                                 type: string
@@ -187,6 +187,10 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''

diff --git a/config/v1alpha1/zz_generated.swagger_doc_generated.go b/config/v1alpha1/zz_generated.swagger_doc_generated.go
diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go
diff --git a/openapi/openapi.json b/openapi/openapi.json
@@ -11324,7 +11324,7 @@
           "type": "string"
         },
         "hostname": {
-          "description": "Hostname specifies the expected hostname imposed on the subject to which the certificate was issued.",
+          "description": "hostname specifies the expected hostname imposed on the subject to which the certificate was issued.",
           "type": "string"
         }
       }

diff --git a/...d-manifests/crds/0000_10_config-operator_01_clusterimagepolicies-CustomNoUpgrade.crd.yaml b/...d-manifests/crds/0000_10_config-operator_01_clusterimagepolicies-CustomNoUpgrade.crd.yaml
@@ -135,7 +135,7 @@ spec:
                                 - message: invalid email address in pkiCertificateSubject
                                   rule: self.matches('^\\S+@\\S+$')
                               hostname:
-                                description: Hostname specifies the expected hostname
+                                description: hostname specifies the expected hostname
                                   imposed on the subject to which the certificate
                                   was issued.
                                 type: string
@@ -187,6 +187,10 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''

diff --git a/...nifests/crds/0000_10_config-operator_01_clusterimagepolicies-DevPreviewNoUpgrade.crd.yaml b/...nifests/crds/0000_10_config-operator_01_clusterimagepolicies-DevPreviewNoUpgrade.crd.yaml
@@ -135,7 +135,7 @@ spec:
                                 - message: invalid email address in pkiCertificateSubject
                                   rule: self.matches('^\\S+@\\S+$')
                               hostname:
-                                description: Hostname specifies the expected hostname
+                                description: hostname specifies the expected hostname
                                   imposed on the subject to which the certificate
                                   was issued.
                                 type: string
@@ -187,6 +187,10 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''

diff --git a/...ifests/crds/0000_10_config-operator_01_clusterimagepolicies-TechPreviewNoUpgrade.crd.yaml b/...ifests/crds/0000_10_config-operator_01_clusterimagepolicies-TechPreviewNoUpgrade.crd.yaml
@@ -111,7 +111,6 @@ spec:
                         enum:
                         - PublicKey
                         - FulcioCAWithRekor
-                        - PKI
                         type: string
                       publicKey:
                         description: publicKey defines the root of trust based on

diff --git a/payload-manifests/crds/0000_10_config-operator_01_imagepolicies-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_imagepolicies-CustomNoUpgrade.crd.yaml
@@ -135,7 +135,7 @@ spec:
                                 - message: invalid email address in pkiCertificateSubject
                                   rule: self.matches('^\\S+@\\S+$')
                               hostname:
-                                description: Hostname specifies the expected hostname
+                                description: hostname specifies the expected hostname
                                   imposed on the subject to which the certificate
                                   was issued.
                                 type: string
@@ -187,6 +187,10 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''