From e5a6b6c2f3301b1dce0bb77925a4b030503eb95d Mon Sep 17 00:00:00 2001 From: Joel Speed Date: Fri, 31 Jul 2026 14:14:48 +0100 Subject: [PATCH 1/2] Use regex instead of format help for KMS secret name validation --- config/v1/types_kmsencryption.go | 6 +++--- ...0_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml | 6 +++--- ...nfig-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml | 6 +++--- ...fig-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml | 6 +++--- .../apiservers.config.openshift.io/KMSEncryption.yaml | 6 +++--- ...0_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml | 6 +++--- ...nfig-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml | 6 +++--- ...fig-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml | 6 +++--- 8 files changed, 24 insertions(+), 24 deletions(-) diff --git a/config/v1/types_kmsencryption.go b/config/v1/types_kmsencryption.go index 0430a25cc30..e2f94ae1f37 100644 --- a/config/v1/types_kmsencryption.go +++ b/config/v1/types_kmsencryption.go @@ -63,7 +63,7 @@ type VaultSecretReference struct { // // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" // +required Name string `json:"name,omitempty"` } @@ -76,7 +76,7 @@ type VaultConfigMapReference struct { // // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" // +required Name string `json:"name,omitempty"` } @@ -300,7 +300,7 @@ type VaultTLSConfig struct { // // +kubebuilder:validation:MaxLength=253 // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" // +optional ServerName string `json:"serverName,omitempty"` } diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index 47f062a8ba6..f3793fac61d 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index 2d0b3c0364b..d06cd26ca79 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index 43b269de69c..cce33594546 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml index ce2f398680d..22c41067598 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index 47f062a8ba6..f3793fac61d 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index 2d0b3c0364b..d06cd26ca79 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index 43b269de69c..cce33594546 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -212,7 +212,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -307,7 +307,7 @@ spec: contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') required: - name type: object @@ -327,7 +327,7 @@ spec: contain no more than 253 characters, contain only lowercase alphanumeric characters, ''-'' or ''.'', and start and end with an alphanumeric character' - rule: '!format.dns1123Subdomain().validate(self).hasValue()' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') type: object vaultAddress: description: |- From 910203b5dd76b272f7ed09d6154447bdc38d360a Mon Sep 17 00:00:00 2001 From: Joel Speed Date: Mon, 3 Aug 2026 11:29:09 +0100 Subject: [PATCH 2/2] Ingress ComponentRoute labels should use regex instead of format CEL library --- config/v1/types_ingress.go | 4 ++-- ..._10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml | 5 +++-- ...config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml | 5 +++-- ...onfig-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml | 5 +++-- .../IngressComponentRouteLabels.yaml | 5 +++-- ..._10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml | 5 +++-- ...config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml | 5 +++-- ...onfig-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml | 5 +++-- 8 files changed, 23 insertions(+), 16 deletions(-) diff --git a/config/v1/types_ingress.go b/config/v1/types_ingress.go index bb461e2f3e2..e581907879a 100644 --- a/config/v1/types_ingress.go +++ b/config/v1/types_ingress.go @@ -171,7 +171,7 @@ const ( // alphanumeric characters, '-', '_', or '.', starting and ending with // an alphanumeric character. // +kubebuilder:validation:MaxLength=63 -// +kubebuilder:validation:XValidation:rule="!format.labelValue().validate(self).hasValue()",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)" +// +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)" type LabelValue string // ConsumingUser is an alias for string which we add validation to. Currently only service accounts are supported. @@ -278,7 +278,7 @@ type ComponentRouteSpec struct { // +mapType=granular // +kubebuilder:validation:MinProperties=1 // +kubebuilder:validation:MaxProperties=8 - // +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character" + // +kubebuilder:validation:XValidation:rule="self.all(key, key.matches('^([a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*\\\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') && key.size() <= 253)",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character" // +kubebuilder:validation:XValidation:rule="self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') && !key.startsWith('openshift.io/'))",message="kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used" Labels map[string]LabelValue `json:"labels,omitempty"` } diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml index 92f29131508..f6717458b50 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml @@ -90,7 +90,7 @@ spec: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -119,7 +119,8 @@ spec: followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml index 42e4209c6b2..236e91a9724 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml @@ -90,7 +90,7 @@ spec: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -119,7 +119,8 @@ spec: followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml index d7fc151b116..f0ec02bed69 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml @@ -90,7 +90,7 @@ spec: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -119,7 +119,8 @@ spec: followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/config/v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml b/config/v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml index bbbb6f595e8..059eec638a3 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml @@ -90,7 +90,7 @@ spec: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -119,7 +119,8 @@ spec: followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml index 92f29131508..f6717458b50 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml @@ -90,7 +90,7 @@ spec: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -119,7 +119,8 @@ spec: followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml index 42e4209c6b2..236e91a9724 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml @@ -90,7 +90,7 @@ spec: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -119,7 +119,8 @@ spec: followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') diff --git a/payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml index d7fc151b116..f0ec02bed69 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml @@ -90,7 +90,7 @@ spec: - message: label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric) - rule: '!format.labelValue().validate(self).hasValue()' + rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') description: |- labels defines additional labels to be applied to the route created for the component. These labels are used by the IngressController to @@ -119,7 +119,8 @@ spec: followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character - rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) + rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') + && key.size() <= 253) - message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/')