Skip to content

Use regex instead of format help for KMS secret name validation #2966

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JoelSpeed wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Use regex instead of format help for KMS secret name validation #2966

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e5a6b6c
Use regex instead of format help for KMS secret name validation
JoelSpeed Jul 31, 2026
910203b
Ingress ComponentRoute labels should use regex instead of format CEL …
JoelSpeed Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions config/v1/types_ingress.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@ const (
// alphanumeric characters, '-', '_', or '.', starting and ending with
// an alphanumeric character.
// +kubebuilder:validation:MaxLength=63
// +kubebuilder:validation:XValidation:rule="!format.labelValue().validate(self).hasValue()",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)"
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)"

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
python - <<'PY'
from pathlib import Path
import re

files = [
    "config/v1/types_ingress.go",
    "payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml",
    "payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml",
    "payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml",
]
expected = "self.matches('^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)?$')"

for filename in files:
    assert expected in Path(filename).read_text(), filename

pattern = re.compile(r"^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)?$")
assert pattern.fullmatch("")
assert pattern.fullmatch("a")
assert pattern.fullmatch("a.b")
assert not pattern.fullmatch("a-")
PY

Repository: openshift/api

Length of output: 268

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for file in \
  config/v1/types_ingress.go \
  payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml \
  payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml \
  payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml
do
  echo "===== $file ====="
  case "$file" in
    *.go) sed -n '160,182p' "$file" ;;
    *.yaml) sed -n '84,100p' "$file" ;;
  esac
done

echo "===== matching ingress label rules ====="
rg -n -C 2 "label values|self\.matches\('\^\[a-zA-Z0-9\]" \
  config/v1/types_ingress.go payload-manifests/crds

echo "===== relevant source context ====="
sed -n '130,190p' config/v1/types_ingress.go

Repository: openshift/api

Length of output: 16795

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re

files = [
    Path("config/v1/types_ingress.go"),
    Path("payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml"),
    Path("payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml"),
    Path("payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml"),
]
old = "self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')"
new = "self.matches('^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)?$')"

print("Rule occurrences:")
for path in files:
    text = path.read_text()
    print(f"{path}: old={text.count(old)}, proposed={text.count(new)}")

old_pattern = re.compile(r"^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$")
new_pattern = re.compile(r"^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)?$")
values = ["", "a", "a.b", "a-b", "a_", "a-", ".a", "a.", "a--b", "a" * 63, "a" * 64]

print("\nInput behavior:")
for value in values:
    print(repr(value), "old=", bool(old_pattern.fullmatch(value)), "proposed=", bool(new_pattern.fullmatch(value)))

print("\nLabelValue references:")
for path in Path(".").rglob("*"):
    if path.is_file() and path.suffix in {".go", ".yaml", ".yml"}:
        try:
            text = path.read_text()
        except UnicodeDecodeError:
            continue
        if "LabelValue" in text:
            print(path)
PY

Repository: openshift/api

Length of output: 5632

🏁 Script executed:

#!/bin/bash
set -euo pipefail

old="self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')"

echo "===== all tracked occurrences of the current rule ====="
git grep -n -F "$old" -- \
  'config/v1/types_ingress.go' \
  'config/v1/zz_generated*' \
  'payload-manifests/crds/*ingresses*.yaml' || true

echo "===== LabelValue declaration and field usage ====="
rg -n -C 4 'type LabelValue|string\(LabelValue\)|LabelValue|ComponentRouteLabels|RouteLabels' \
  config/v1 --glob '*.go' --glob '*.yaml'

echo "===== generated schema locations ====="
for file in config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-*.crd.yaml \
            config/v1/zz_generated.featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml
do
  if [ -f "$file" ]; then
    echo "===== $file ====="
    rg -n -C 5 'label values|self\.matches|labels defines additional labels' "$file"
  fi
done

echo "===== focused tests mentioning ingress labels or LabelValue ====="
rg -n -i -C 3 'LabelValue|component route labels|route labels|empty label|label value' \
  config tests --glob '*.go' --glob '*.yaml' --glob '*.yml' | head -240 || true

Repository: openshift/api

Length of output: 16722

Allow empty LabelValue values in all generated CRDs.

The current validation rejects "", although the type documentation and Kubernetes label rules permit empty values. Make the complete non-empty regex alternative optional, regenerate the affected CRDs under config/v1/zz_generated* and payload-manifests/crds, and add regression coverage for empty, one-character, valid, and trailing-separator values.

📍 Affects 4 files
  • config/v1/types_ingress.go#L174-L174 (this comment)
  • payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml#L93-L93
  • payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml#L93-L93
  • payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml#L93-L93
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/v1/types_ingress.go` at line 174, Make the LabelValue XValidation
regex optional so empty values pass while preserving rejection of invalid
non-empty values and trailing separators; update the validation in
config/v1/types_ingress.go:174, regenerate the affected config/v1/zz_generated*
CRDs, and update the corresponding schemas in
payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml:93,
payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml:93,
and
payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml:93.
Add regression coverage for empty, one-character, valid, and trailing-separator
LabelValue inputs.

type LabelValue string

// ConsumingUser is an alias for string which we add validation to. Currently only service accounts are supported.
Expand Down Expand Up @@ -278,7 +278,7 @@ type ComponentRouteSpec struct {
// +mapType=granular
// +kubebuilder:validation:MinProperties=1
// +kubebuilder:validation:MaxProperties=8
// +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character"
// +kubebuilder:validation:XValidation:rule="self.all(key, key.matches('^([a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*\\\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') && key.size() <= 253)",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character"

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
files=(
  config/v1/types_ingress.go
  payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml
  payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml
  payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml
)

if rg -n --fixed-strings 'key.size() <= 253' "${files[@]}"; then
  echo "The total-key length check is still present." >&2
  exit 1
fi

python - <<'PY'
prefix = ".".join(["a" * 63, "b" * 63, "c" * 63, "d" * 61])
assert len(prefix) == 253
assert len(prefix + "/x") == 255
assert len("a" * 64) == 64
print("Qualified-name boundary fixtures are ready for API-server validation tests.")
PY

Repository: openshift/api

Length of output: 1184

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- source and generated rules ---'
sed -n '270,288p' config/v1/types_ingress.go
for f in \
  payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml \
  payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml \
  payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml
do
  echo "--- $f ---"
  sed -n '115,128p' "$f"
done

echo '--- related validation and tests ---'
rg -n -S 'key\.size\(\)|qualified name|QualifiedName|label keys|types_ingress|Ingress' \
  config payload-manifests --glob '*.go' --glob '*.yaml' --glob '*_test.go' \
  | head -200

Repository: openshift/api

Length of output: 43807

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import re

# The Go annotation and CRDs express this same logical regex after escaping.
pattern = re.compile(
    r'^([a-z0-9]([a-z0-9\-]*[a-z0-9])?'
    r'(\.[a-z0-9]([a-z0-9\-]*[a-z0-9])?)*\/)?'
    r'[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$'
)

def current_accepts(key):
    return bool(pattern.fullmatch(key)) and len(key) <= 253

cases = {
    "64-character name": "n" * 64,
    "64-character DNS label": ("a" * 64) + "/x",
    "253-character prefix plus /x":
        ".".join(["a" * 63, "b" * 63, "c" * 63, "d" * 61]) + "/x",
    "valid 63-character name": "n" * 63,
    "valid 63-character DNS label": ("a" * 63) + "/x",
}
for name, key in cases.items():
    print(f"{name}: key_length={len(key)} regex={bool(pattern.fullmatch(key))} current_rule={current_accepts(key)}")
PY

Repository: openshift/api

Length of output: 496

Validate qualified-name segments independently.

The rule accepts 64-character name and DNS-label segments and rejects a valid 253-character prefix followed by /x. Bound each prefix label and the name segment separately, then regenerate all three CRDs and add boundary tests.

📍 Affects 4 files
  • config/v1/types_ingress.go#L281-L281 (this comment)
  • payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml#L122-L123
  • payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml#L122-L123
  • payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml#L122-L123
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/v1/types_ingress.go` at line 281, Update the XValidation rule on the
ingress label-key field in config/v1/types_ingress.go so each DNS prefix label
and the name segment are length-validated independently, enforcing the
qualified-name limits while allowing a valid 253-character prefix plus “/x”;
then regenerate all three CRDs. Apply the generated schema changes to
payload-manifests/crds/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml:122-123,
payload-manifests/crds/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml:122-123,
and
payload-manifests/crds/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml:122-123,
and add boundary tests covering valid and invalid segment lengths.

// +kubebuilder:validation:XValidation:rule="self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') && !key.startsWith('openshift.io/'))",message="kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used"
Labels map[string]LabelValue `json:"labels,omitempty"`
}
Expand Down
6 changes: 3 additions & 3 deletions config/v1/types_kmsencryption.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ type VaultSecretReference struct {
//
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=253
// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +required
Name string `json:"name,omitempty"`
}
Expand All @@ -76,7 +76,7 @@ type VaultConfigMapReference struct {
//
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=253
// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +required
Name string `json:"name,omitempty"`
}
Expand Down Expand Up @@ -300,7 +300,7 @@ type VaultTLSConfig struct {
//
// +kubebuilder:validation:MaxLength=253
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +optional
ServerName string `json:"serverName,omitempty"`
}
6 changes: 3 additions & 3 deletions ...zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with
an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -307,7 +307,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with an
alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand All @@ -327,7 +327,7 @@ spec:
contain no more than 253 characters, contain only
lowercase alphanumeric characters, ''-'' or ''.'',
and start and end with an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
type: object
vaultAddress:
description: |-
Expand Down
6 changes: 3 additions & 3 deletions ...enerated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with
an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -307,7 +307,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with an
alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand All @@ -327,7 +327,7 @@ spec:
contain no more than 253 characters, contain only
lowercase alphanumeric characters, ''-'' or ''.'',
and start and end with an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
type: object
vaultAddress:
description: |-
Expand Down
6 changes: 3 additions & 3 deletions ...nerated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with
an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -307,7 +307,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with an
alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand All @@ -327,7 +327,7 @@ spec:
contain no more than 253 characters, contain only
lowercase alphanumeric characters, ''-'' or ''.'',
and start and end with an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
type: object
vaultAddress:
description: |-
Expand Down
5 changes: 3 additions & 2 deletions .../zz_generated.crd-manifests/0000_10_config-operator_01_ingresses-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ spec:
- message: label values must be valid Kubernetes label values
(at most 63 characters, alphanumeric, '-', '_', or '.',
must start and end with alphanumeric)
rule: '!format.labelValue().validate(self).hasValue()'
rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')
description: |-
labels defines additional labels to be applied to the route created
for the component. These labels are used by the IngressController to
Expand Down Expand Up @@ -119,7 +119,8 @@ spec:
followed by a slash and a name segment of 1-63 characters,
that consists only of alphanumeric characters, dashes, underscores,
and dots, and must start and end with an alphanumeric character
rule: self.all(key, !format.qualifiedName().validate(key).hasValue())
rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')
&& key.size() <= 253)
- message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed
label keys are reserved and may not be used
rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/')
Expand Down
5 changes: 3 additions & 2 deletions ...generated.crd-manifests/0000_10_config-operator_01_ingresses-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ spec:
- message: label values must be valid Kubernetes label values
(at most 63 characters, alphanumeric, '-', '_', or '.',
must start and end with alphanumeric)
rule: '!format.labelValue().validate(self).hasValue()'
rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')
description: |-
labels defines additional labels to be applied to the route created
for the component. These labels are used by the IngressController to
Expand Down Expand Up @@ -119,7 +119,8 @@ spec:
followed by a slash and a name segment of 1-63 characters,
that consists only of alphanumeric characters, dashes, underscores,
and dots, and must start and end with an alphanumeric character
rule: self.all(key, !format.qualifiedName().validate(key).hasValue())
rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')
&& key.size() <= 253)
- message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed
label keys are reserved and may not be used
rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/')
Expand Down
5 changes: 3 additions & 2 deletions ...enerated.crd-manifests/0000_10_config-operator_01_ingresses-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ spec:
- message: label values must be valid Kubernetes label values
(at most 63 characters, alphanumeric, '-', '_', or '.',
must start and end with alphanumeric)
rule: '!format.labelValue().validate(self).hasValue()'
rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')
description: |-
labels defines additional labels to be applied to the route created
for the component. These labels are used by the IngressController to
Expand Down Expand Up @@ -119,7 +119,8 @@ spec:
followed by a slash and a name segment of 1-63 characters,
that consists only of alphanumeric characters, dashes, underscores,
and dots, and must start and end with an alphanumeric character
rule: self.all(key, !format.qualifiedName().validate(key).hasValue())
rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')
&& key.size() <= 253)
- message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed
label keys are reserved and may not be used
rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/')
Expand Down
6 changes: 3 additions & 3 deletions ...zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with
an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -307,7 +307,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with an
alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand All @@ -327,7 +327,7 @@ spec:
contain no more than 253 characters, contain only
lowercase alphanumeric characters, ''-'' or ''.'',
and start and end with an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
type: object
vaultAddress:
description: |-
Expand Down
5 changes: 3 additions & 2 deletions ...featuregated-crd-manifests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ spec:
- message: label values must be valid Kubernetes label values
(at most 63 characters, alphanumeric, '-', '_', or '.',
must start and end with alphanumeric)
rule: '!format.labelValue().validate(self).hasValue()'
rule: self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')
description: |-
labels defines additional labels to be applied to the route created
for the component. These labels are used by the IngressController to
Expand Down Expand Up @@ -119,7 +119,8 @@ spec:
followed by a slash and a name segment of 1-63 characters,
that consists only of alphanumeric characters, dashes, underscores,
and dots, and must start and end with an alphanumeric character
rule: self.all(key, !format.qualifiedName().validate(key).hasValue())
rule: self.all(key, key.matches('^([a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')
&& key.size() <= 253)
- message: kubernetes.io/, k8s.io/, and openshift.io/ prefixed
label keys are reserved and may not be used
rule: self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/')
Expand Down
Loading