Skip to content

Commit fad886a

Browse files
jaypoulzjaypoulz
committed
chore(tools): bump controller-tools with XValidation ordering fix
Update controller-tools to jaypoulz/controller-tools fork which includes a fix for deterministic XValidation rule ordering. This ensures CRD generation produces consistent output regardless of map iteration order. Changes included: - tools/go.mod: Point replace directive to jaypoulz/controller-tools - tools/Makefile: Fix openapi-gen path (moved from code-generator to kube-openapi upstream) - tools/codegen/pkg/crdify/generator.go: Ignore 'type' validation for allOf→enum schema simplification - tools/codegen/pkg/schemacheck/generator.go: Disable NoDataTypeChange comparator for the same schema simplification The new controller-tools generates simpler enum schemas without allOf wrappers when both type and field have enum markers. This is functionally equivalent but structurally different, requiring the crdify and schemacheck adjustments to avoid false positive violations. Upstream fix: kubernetes-sigs/controller-tools#1324 OpenShift carry: openshift/kubernetes-sigs-controller-tools#33 The OpenShift carry is a temporary backport until we can bump to Go 1.25, which is required by the upstream controller-tools version with this fix. Created with support from Claude Opus 4 (Anthropic)
1 parent 6fb7fda commit fad886a

199 files changed

Lines changed: 2201 additions & 2207 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎config/v1/tests/authentications.config.openshift.io/ExternalOIDC.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ tests:
123123
prefixPolicy: NoPrefix
124124
- name: Cannot set OIDC providers with no claim mappings
125125
initial: |
126-
apiVersion: config.openshift.io/v1
126+
apiVersion: config.openshift.io/v1
127127
kind: Authentication
128128
spec:
129129
type: OIDC
@@ -699,7 +699,7 @@ tests:
699699
- name: Should allow updating other fields if issuerURL has a query
700700
initialCRDPatches:
701701
- op: remove
702-
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/oidcProviders/items/properties/issuer/properties/issuerURL/x-kubernetes-validations/2
702+
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/oidcProviders/items/properties/issuer/properties/issuerURL/x-kubernetes-validations/1
703703
initial: |
704704
apiVersion: config.openshift.io/v1
705705
kind: Authentication
@@ -742,7 +742,7 @@ tests:
742742
- name: Should allow updating issuerURL from a previously invalid value to a valid value (query)
743743
initialCRDPatches:
744744
- op: remove
745-
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/oidcProviders/items/properties/issuer/properties/issuerURL/x-kubernetes-validations/2
745+
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/oidcProviders/items/properties/issuer/properties/issuerURL/x-kubernetes-validations/1
746746
initial: |
747747
apiVersion: config.openshift.io/v1
748748
kind: Authentication
@@ -785,7 +785,7 @@ tests:
785785
- name: Should not allow updating issuerURL from a previously invalid value to a still invalid value (query)
786786
initialCRDPatches:
787787
- op: remove
788-
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/oidcProviders/items/properties/issuer/properties/issuerURL/x-kubernetes-validations/2
788+
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/oidcProviders/items/properties/issuer/properties/issuerURL/x-kubernetes-validations/1
789789
initial: |
790790
apiVersion: config.openshift.io/v1
791791
kind: Authentication

‎config/v1/tests/infrastructures.config.openshift.io/DyanmicServiceEndpointIBMCloud.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
22
name: "Infrastructure"
33
crdName: infrastructures.config.openshift.io
4-
featureGates:
4+
featureGates:
55
- DyanmicServiceEndpointIBMCloud
66
tests:
77
onCreate:
@@ -50,7 +50,7 @@ tests:
5050
serviceEndpoints:
5151
- name: VPC
5252
url: " "
53-
expectedError: "spec.platformSpec.ibmcloud.serviceEndpoints[0].url: Invalid value: \"string\": URL parse error during conversion from string: parse \" \": invalid URI for request evaluating rule: url must use https scheme, spec.platformSpec.ibmcloud.serviceEndpoints[0].url: Invalid value: \"string\": URL parse error during conversion from string: parse \" \": invalid URI for request evaluating rule: url path must match /v[0,9]+ or /api/v[0,9]+, spec.platformSpec.ibmcloud.serviceEndpoints[0].url: Invalid value: \"string\": url must be a valid absolute URL]"
53+
expectedError: "spec.platformSpec.ibmcloud.serviceEndpoints[0].url: Invalid value: \"string\": url must be a valid absolute URL, spec.platformSpec.ibmcloud.serviceEndpoints[0].url: Invalid value: \"string\": URL parse error during conversion from string: parse \" \": invalid URI for request evaluating rule: url path must match /v[0,9]+ or /api/v[0,9]+, spec.platformSpec.ibmcloud.serviceEndpoints[0].url: Invalid value: \"string\": URL parse error during conversion from string: parse \" \": invalid URI for request evaluating rule: url must use https scheme]"
5454
- name: Should not be able to add invalid ServiceEndpoint (incorect URL path) to IBMCloud PlatformSpec
5555
initial: |
5656
apiVersion: config.openshift.io/v1

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -121,33 +121,33 @@ spec:
121121
minLength: 1
122122
type: string
123123
x-kubernetes-validations:
124-
- message: key must contain the '/' character
125-
rule: self.contains('/')
126-
- message: the domain of the key must consist of only
127-
lower case alphanumeric characters, '-' or '.',
128-
and must start and end with an alphanumeric character
129-
rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
130-
- message: the domain of the key must not exceed 253
131-
characters in length
132-
rule: self.split('/', 2)[0].size() <= 253
133-
- message: the domain 'kubernetes.io' is reserved
124+
- message: the subdomains '*.k8s.io' are reserved
134125
for Kubernetes use
135-
rule: self.split('/', 2)[0] != 'kubernetes.io'
126+
rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
136127
- message: the subdomains '*.kubernetes.io' are reserved
137128
for Kubernetes use
138129
rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
130+
- message: the subdomains '*.openshift.io' are reserved
131+
for OpenShift use
132+
rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
133+
- message: key must contain the '/' character
134+
rule: self.contains('/')
139135
- message: the domain 'k8s.io' is reserved for Kubernetes
140136
use
141137
rule: self.split('/', 2)[0] != 'k8s.io'
142-
- message: the subdomains '*.k8s.io' are reserved
138+
- message: the domain 'kubernetes.io' is reserved
143139
for Kubernetes use
144-
rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
140+
rule: self.split('/', 2)[0] != 'kubernetes.io'
145141
- message: the domain 'openshift.io' is reserved for
146142
OpenShift use
147143
rule: self.split('/', 2)[0] != 'openshift.io'
148-
- message: the subdomains '*.openshift.io' are reserved
149-
for OpenShift use
150-
rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
144+
- message: the domain of the key must consist of only
145+
lower case alphanumeric characters, '-' or '.',
146+
and must start and end with an alphanumeric character
147+
rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
148+
- message: the domain of the key must not exceed 253
149+
characters in length
150+
rule: self.split('/', 2)[0].size() <= 253
151151
- message: the path of the key must not be empty and
152152
must consist of at least one alphanumeric character,
153153
percent-encoded octets, apostrophe, '-', '.',
@@ -470,16 +470,16 @@ spec:
470470
minLength: 1
471471
type: string
472472
x-kubernetes-validations:
473+
- message: discoveryURL must not contain user info
474+
rule: '!self.matches(''^https://.+:.+@.+/.*$'')'
473475
- message: discoveryURL must be a valid URL
474476
rule: isURL(self)
475-
- message: discoveryURL must be a valid https URL
476-
rule: url(self).getScheme() == 'https'
477-
- message: discoveryURL must not contain query parameters
478-
rule: url(self).getQuery().size() == 0
479477
- message: discoveryURL must not contain fragments
480478
rule: self.matches('^[^#]*$')
481-
- message: discoveryURL must not contain user info
482-
rule: '!self.matches(''^https://.+:.+@.+/.*$'')'
479+
- message: discoveryURL must not contain query parameters
480+
rule: url(self).getQuery().size() == 0
481+
- message: discoveryURL must be a valid https URL
482+
rule: url(self).getScheme() == 'https'
483483
issuerCertificateAuthority:
484484
description: |-
485485
issuerCertificateAuthority is an optional field that configures the
@@ -514,10 +514,10 @@ spec:
514514
x-kubernetes-validations:
515515
- message: must be a valid URL
516516
rule: isURL(self)
517-
- message: must use the 'https' scheme
518-
rule: isURL(self) && url(self).getScheme() == 'https'
519517
- message: must not have a query
520518
rule: isURL(self) && url(self).getQuery() == {}
519+
- message: must use the 'https' scheme
520+
rule: isURL(self) && url(self).getScheme() == 'https'
521521
- message: must not have a fragment
522522
rule: self.find('#(.+)$') == ''
523523
- message: must not have user info

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -121,33 +121,33 @@ spec:
121121
minLength: 1
122122
type: string
123123
x-kubernetes-validations:
124-
- message: key must contain the '/' character
125-
rule: self.contains('/')
126-
- message: the domain of the key must consist of only
127-
lower case alphanumeric characters, '-' or '.',
128-
and must start and end with an alphanumeric character
129-
rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
130-
- message: the domain of the key must not exceed 253
131-
characters in length
132-
rule: self.split('/', 2)[0].size() <= 253
133-
- message: the domain 'kubernetes.io' is reserved
124+
- message: the subdomains '*.k8s.io' are reserved
134125
for Kubernetes use
135-
rule: self.split('/', 2)[0] != 'kubernetes.io'
126+
rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
136127
- message: the subdomains '*.kubernetes.io' are reserved
137128
for Kubernetes use
138129
rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
130+
- message: the subdomains '*.openshift.io' are reserved
131+
for OpenShift use
132+
rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
133+
- message: key must contain the '/' character
134+
rule: self.contains('/')
139135
- message: the domain 'k8s.io' is reserved for Kubernetes
140136
use
141137
rule: self.split('/', 2)[0] != 'k8s.io'
142-
- message: the subdomains '*.k8s.io' are reserved
138+
- message: the domain 'kubernetes.io' is reserved
143139
for Kubernetes use
144-
rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
140+
rule: self.split('/', 2)[0] != 'kubernetes.io'
145141
- message: the domain 'openshift.io' is reserved for
146142
OpenShift use
147143
rule: self.split('/', 2)[0] != 'openshift.io'
148-
- message: the subdomains '*.openshift.io' are reserved
149-
for OpenShift use
150-
rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
144+
- message: the domain of the key must consist of only
145+
lower case alphanumeric characters, '-' or '.',
146+
and must start and end with an alphanumeric character
147+
rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
148+
- message: the domain of the key must not exceed 253
149+
characters in length
150+
rule: self.split('/', 2)[0].size() <= 253
151151
- message: the path of the key must not be empty and
152152
must consist of at least one alphanumeric character,
153153
percent-encoded octets, apostrophe, '-', '.',
@@ -461,10 +461,10 @@ spec:
461461
x-kubernetes-validations:
462462
- message: must be a valid URL
463463
rule: isURL(self)
464-
- message: must use the 'https' scheme
465-
rule: isURL(self) && url(self).getScheme() == 'https'
466464
- message: must not have a query
467465
rule: isURL(self) && url(self).getQuery() == {}
466+
- message: must use the 'https' scheme
467+
rule: isURL(self) && url(self).getScheme() == 'https'
468468
- message: must not have a fragment
469469
rule: self.find('#(.+)$') == ''
470470
- message: must not have user info

0 commit comments

Comments
 (0)