Move MDR unique validations to CEL

Signed-off-by: Stefan Büringer [email protected]

Author: sbueringer

api/v1beta1/machinedrainrules_types.go

@@ -79,6 +79,7 @@ type MachineDrainRuleSpec struct {
 	// +listType=atomic
 	// +kubebuilder:validation:MinItems=1
 	// +kubebuilder:validation:MaxItems=32
+	// +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x == y))",message="entries in machines must be unique"
 	Machines []MachineDrainRuleMachineSelector `json:"machines,omitempty"`
 
 	// pods defines to which Pods this MachineDrainRule should be applied.
@@ -110,6 +111,7 @@ type MachineDrainRuleSpec struct {
 	// +listType=atomic
 	// +kubebuilder:validation:MinItems=1
 	// +kubebuilder:validation:MaxItems=32
+	// +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x == y))",message="entries in pods must be unique"
 	Pods []MachineDrainRulePodSelector `json:"pods,omitempty"`
 }
 

config/crd/bases/cluster.x-k8s.io_machinedrainrules.yaml

@@ -19,7 +19,6 @@ package webhooks
 import (
 	"context"
 	"fmt"
-	"reflect"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -101,14 +100,7 @@ func (webhook *MachineDrainRule) validate(newMDR *clusterv1.MachineDrainRule) er
 func ValidateMachineDrainRulesSelectors(machineDrainRule *clusterv1.MachineDrainRule) field.ErrorList {
 	var allErrs field.ErrorList
 
-	machinesSelectorUnique := true
 	for i, machineSelector := range machineDrainRule.Spec.Machines {
-		for j := range i {
-			if machinesSelectorUnique && reflect.DeepEqual(machineDrainRule.Spec.Machines[i], machineDrainRule.Spec.Machines[j]) {
-				machinesSelectorUnique = false
-			}
-		}
-
 		if machineSelector.Selector != nil {
 			if _, err := metav1.LabelSelectorAsSelector(machineSelector.Selector); err != nil {
 				allErrs = append(allErrs,
@@ -124,20 +116,8 @@ func ValidateMachineDrainRulesSelectors(machineDrainRule *clusterv1.MachineDrain
 			}
 		}
 	}
-	if !machinesSelectorUnique {
-		allErrs = append(allErrs,
-			field.Forbidden(field.NewPath("spec", "machines"), "Entries in machines must be unique"),
-		)
-	}
 
-	podsSelectorUnique := true
 	for i, podSelector := range machineDrainRule.Spec.Pods {
-		for j := range i {
-			if podsSelectorUnique && reflect.DeepEqual(machineDrainRule.Spec.Pods[i], machineDrainRule.Spec.Pods[j]) {
-				podsSelectorUnique = false
-			}
-		}
-
 		if podSelector.Selector != nil {
 			if _, err := metav1.LabelSelectorAsSelector(podSelector.Selector); err != nil {
 				allErrs = append(allErrs,
@@ -153,11 +133,6 @@ func ValidateMachineDrainRulesSelectors(machineDrainRule *clusterv1.MachineDrain
 			}
 		}
 	}
-	if !podsSelectorUnique {
-		allErrs = append(allErrs,
-			field.Forbidden(field.NewPath("spec", "pods"), "Entries in pods must be unique"),
-		)
-	}
 
 	return allErrs
 }

internal/webhooks/machinedrainrules.go

@@ -216,10 +216,9 @@ func Test_validate(t *testing.T) {
 					},
 				},
 			},
-			wantErr: "admission webhook \"validation.machinedrainrule.cluster.x-k8s.io\" denied the request: " +
-				"MachineDrainRule.cluster.x-k8s.io \"mdr\" is invalid: [" +
-				"spec.machines: Forbidden: Entries in machines must be unique, " +
-				"spec.pods: Forbidden: Entries in pods must be unique]",
+			wantErr: "MachineDrainRule.cluster.x-k8s.io \"mdr\" is invalid: [" +
+				"spec.machines: Invalid value: \"array\": entries in machines must be unique, " +
+				"spec.pods: Invalid value: \"array\": entries in pods must be unique]",
 		},
 	}