From e5a6b6c2f3301b1dce0bb77925a4b030503eb95d Mon Sep 17 00:00:00 2001 From: Joel Speed Date: Fri, 31 Jul 2026 14:14:48 +0100 Subject: [PATCH 1/3] Use regex instead of format help for KMS secret name validation --- config/v1/types_kmsencryption.go | 6 +++--- ...0_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml | 6 +++--- ...nfig-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml | 6 +++--- ...fig-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml | 6 +++--- .../apiservers.config.openshift.io/KMSEncryption.yaml | 6 +++--- ...0_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml | 6 +++--- ...nfig-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml | 6 +++--- ...fig-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml | 6 +++--- 8 files changed, 24 insertions(+), 24 deletions(-) diff --git a/config/v1/types_kmsencryption.go b/config/v1/types_kmsencryption.go index 0430a25cc30..e2f94ae1f37 100644 --- a/config/v1/types_kmsencryption.go +++ b/config/v1/types_kmsencryption.go @@ -63,7 +63,7 @@ type VaultSecretReference struct { // // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" // +required Name string `json:"name,omitempty"` } @@ -76,7 +76,7 @@ type VaultConfigMapReference struct { // // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" // +required Name string `json:"name,omitempty"` } @@ -300,7 +300,7 @@ type VaultTLSConfig struct { // // +kubebuilder:validation:MaxLength=253 // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" // +optional ServerName string `json:"serverName,omitempty"` } diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index 47f062a8ba6..f3793fac61d 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index 2d0b3c0364b..d06cd26ca79 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index 43b269de69c..cce33594546 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml index ce2f398680d..22c41067598 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index 47f062a8ba6..f3793fac61d 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index 2d0b3c0364b..d06cd26ca79 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index 43b269de69c..cce33594546 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- From eeecccec09607de0e0432dd5e23255c39ee06200 Mon Sep 17 00:00:00 2001 From: Joel Speed Date: Mon, 3 Aug 2026 11:29:09 +0100 Subject: [PATCH 2/3] Ingress ComponentRoute labels should use regex instead of format CEL library --- .../IngressComponentRouteLabels.yaml | 2 +- config/v1/types_ingress.go | 6 ++++-- ...config-operator_01_ingresses-CustomNoUpgrade.crd.yaml | 9 +++++++-- ...ig-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml | 9 +++++++-- ...g-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml | 9 +++++++-- .../IngressComponentRouteLabels.yaml | 9 +++++++-- ...config-operator_01_ingresses-CustomNoUpgrade.crd.yaml | 9 +++++++-- ...ig-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml | 9 +++++++-- ...g-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml | 9 +++++++-- 9 files changed, 54 insertions(+), 17 deletions(-) diff --git a/config/v1/tests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml b/config/v1/tests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml index fe3635d4a25..6fdb9e7a14a 100644 --- a/config/v1/tests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml +++ b/config/v1/tests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml @@ -230,7 +230,7 @@ tests: hostname: console.example.com labels: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa: value - expectedError: "label keys must be valid qualified names, consisting of an optional DNS subdomain prefix" + expectedError: "label keys must be between 1 and 63 characters in length" - name: Should reject componentRoutes with label value starting with dash initial: | apiVersion: config.openshift.io/v1 diff --git a/config/v1/types_ingress.go b/config/v1/types_ingress.go index bb461e2f3e2..622bce0345d 100644 --- a/config/v1/types_ingress.go +++ b/config/v1/types_ingress.go @@ -171,7 +171,8 @@ const ( // alphanumeric characters, '-', '_', or '.', starting and ending with // an alphanumeric character. // +kubebuilder:validation:MaxLength=63 -// +kubebuilder:validation:XValidation:rule="!format.labelValue().validate(self).hasValue()",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)" +// +kubebuilder:validation:MinLength=0 +// +kubebuilder:validation:XValidation:rule="self == \"\" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)" type LabelValue string // ConsumingUser is an alias for string which we add validation to. Currently only service accounts are supported. @@ -278,7 +279,8 @@ type ComponentRouteSpec struct { // +mapType=granular // +kubebuilder:validation:MinProperties=1 // +kubebuilder:validation:MaxProperties=8 - // +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.all(key, key.size() <= 63 && key.size() > 0)",message="label keys must be between 1 and 63 characters in length" + // +kubebuilder:validation:XValidation:rule="self.all(key, key.matches('^([a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*\\\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') && key.size() <= 253)",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character" // +kubebuilder:validation:XValidation:rule="self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') && !key.startsWith('openshift.io/'))",message="kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used" Labels map[string]LabelValue `json:"labels,omitempty"` } diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml index 92f29131508..c94de0ff2ee 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml index 42e4209c6b2..860bde0fb25 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml index d7fc151b116..204708d8710 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/config/v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml b/config/v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml index bbbb6f595e8..8c9fa5b9d3b 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml index 92f29131508..c94de0ff2ee 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml index 42e4209c6b2..860bde0fb25 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml index d7fc151b116..204708d8710 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml @@ -85,12 +85,13 @@ spec: alphanumeric characters, '-', '_', or '.', starting and ending with an alphanumeric character. maxLength: 63 + minLength: 0 type: string x-kubernetes-validations: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self == "" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -114,12 +115,16 @@ spec: type: object x-kubernetes-map-type: granular x-kubernetes-validations: + - message: label keys must be between 1 and 63 characters in + length + rule: self.all(key, key.size() <= 63 && key.size() > 0) - message: label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') From 5289f8548756ea0b8cbafb8deae12be468a0de00 Mon Sep 17 00:00:00 2001 From: Joel Speed Date: Tue, 4 Aug 2026 14:36:27 +0100 Subject: [PATCH 3/3] Authentication config must not use format validations --- config/v1/types_authentication.go | 6 +++--- ...g-operator_01_authentications-CustomNoUpgrade.crd.yaml | 8 ++++---- ...erator_01_authentications-DevPreviewNoUpgrade.crd.yaml | 8 ++++---- ...rator_01_authentications-TechPreviewNoUpgrade.crd.yaml | 8 ++++---- .../ExternalOIDCExternalClaimsSourcing.yaml | 8 ++++---- ...g-operator_01_authentications-CustomNoUpgrade.crd.yaml | 8 ++++---- ...erator_01_authentications-DevPreviewNoUpgrade.crd.yaml | 8 ++++---- ...rator_01_authentications-TechPreviewNoUpgrade.crd.yaml | 8 ++++---- 8 files changed, 31 insertions(+), 31 deletions(-) diff --git a/config/v1/types_authentication.go b/config/v1/types_authentication.go index 348ee040107..ab591284d96 100644 --- a/config/v1/types_authentication.go +++ b/config/v1/types_authentication.go @@ -1087,7 +1087,7 @@ type SourceURL struct { // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=259 // +kubebuilder:validation:XValidation:rule="isURL('https://'+self)",message="hostname must be a valid hostname" - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self.split(':')[0]).hasValue()",message="hostname before port must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" + // +kubebuilder:validation:XValidation:rule="self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')",message="hostname before port must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" // +kubebuilder:validation:XValidation:rule="self.split(':').size() > 1 ? int(self.split(':')[1]) <= 65535 : true",message="port must not exceed 65535" Hostname string `json:"hostname,omitempty"` @@ -1194,7 +1194,7 @@ type ExternalSourceCertificateAuthorityConfigMapReference struct { // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" Name string `json:"name,omitempty"` } @@ -1211,6 +1211,6 @@ type ClientSecretSecretReference struct { // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'" Name string `json:"name,omitempty"` } diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml index 8c2695a5818..ebf8cefe088 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml @@ -518,7 +518,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -583,7 +583,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -791,7 +791,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -827,7 +827,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true' diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml index 09111b08cea..e5f0c9bb9b2 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml @@ -518,7 +518,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -583,7 +583,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -791,7 +791,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -827,7 +827,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true' diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml index d883307d841..47e5625bb96 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml @@ -518,7 +518,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -583,7 +583,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -791,7 +791,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -827,7 +827,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true' diff --git a/config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml b/config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml index 27bcaf0d031..2b7bf2769e2 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml @@ -306,7 +306,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -371,7 +371,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -579,7 +579,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -615,7 +615,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true' diff --git a/payload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml index 8c2695a5818..ebf8cefe088 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml @@ -518,7 +518,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -583,7 +583,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -791,7 +791,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -827,7 +827,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true' diff --git a/payload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml index 09111b08cea..e5f0c9bb9b2 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml @@ -518,7 +518,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -583,7 +583,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -791,7 +791,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -827,7 +827,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true' diff --git a/payload-manifests/crds/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml index d883307d841..47e5625bb96 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml @@ -518,7 +518,7 @@ spec: lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -583,7 +583,7 @@ spec: a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -791,7 +791,7 @@ spec: alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') required: - name type: object @@ -827,7 +827,7 @@ spec: with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.' - rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()' + rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$') - message: port must not exceed 65535 rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1]) <= 65535 : true'