feat: validating admission webhook for v1alpha2 Silences - #661
Open
QuentinBisson wants to merge 4 commits into
Open
feat: validating admission webhook for v1alpha2 Silences#661QuentinBisson wants to merge 4 commits into
QuentinBisson wants to merge 4 commits into
Conversation
Enforces business rules not expressible in the CRD OpenAPI schema: - No duplicate matchers (same name+value+matchType) - Regex matchers (=~ / !~) must compile as valid Go regular expressions - valid-until annotation must parse as RFC3339 or date-only - On CREATE: valid-until must not already be in the past - UPDATE allows past valid-until so the controller expires silences naturally Enabled via --webhook-validating-enabled=true (set by Helm when webhook.enabled=true). Shares TLS cert, Service, and cert-manager Certificate with the mutating webhook. 18 unit tests covering all validation paths and multi-error aggregation. config/webhook/manifests.yaml updated via controller-gen.
webhook.mutating.enabled and webhook.validating.enabled (both default true) allow each webhook type to be toggled independently under the shared webhook.enabled master switch. - MutatingWebhookConfiguration only rendered when both webhook.enabled and webhook.mutating.enabled are true - ValidatingWebhookConfiguration only rendered when both webhook.enabled and webhook.validating.enabled are true - --webhook-cel-rules only passed to the operator when mutating.enabled - --webhook-validating-enabled only passed when validating.enabled Use cases: validating only (no CEL rules yet): mutating.enabled: false mutating only (skip validation): validating.enabled: false both (default): no overrides needed
celRules belongs to the mutating webhook, not the webhook section as a whole. Move it to webhook.mutating.celRules and relocate all examples and CEL documentation to sit directly alongside the field. Also updates values.schema.json and the deployment template accordingly. Signed-off-by: QuentinBisson <quentin@giantswarm.io>
QuentinBisson
force-pushed
the
feat/validating-webhook
branch
from
April 8, 2026 12:56
24714f3 to
12e6f1e
Compare
Contributor
Author
|
Tested on graveler |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on #660. Adds a validating webhook that enforces business rules the CRD OpenAPI schema cannot express.
Validations:
=~and!~matchers must compile as valid Go regular expressions; bad patterns are caught at admission, not silently at sync timevalid-untilparseability — annotation must be RFC3339 or date-only (YYYY-MM-DD); bad format returns a clear error with accepted examples