validate resource names for dns compliance

Signed-off-by: Will Kutler <[email protected]>

Author: willkutler

internal/plugin.go

@@ -13,6 +13,7 @@ import (
 
 	yaml "gopkg.in/yaml.v3"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/util/validation"
 	"open-cluster-management.io/ocm-kustomize-generator-plugins/internal/types"
 )
 
@@ -30,6 +31,8 @@ const (
 	placementAPIVersion        = "cluster.open-cluster-management.io/v1beta1"
 	placementKind              = "Placement"
 	maxObjectNameLength        = 63
+	dnsReference               = "https://kubernetes.io/docs/concepts/overview/working-with-objects/names/" +
+		"#dns-subdomain-names"
 )
 
 // Plugin is used to store the PolicyGenerator configuration and the methods to generate the
@@ -648,6 +651,41 @@ func (p *Plugin) assertValidConfig() error {
 		)
 	}
 
+	// validate placement and binding names are DNS compliant
+	defPlrName := p.PolicyDefaults.Placement.PlacementRuleName
+	if defPlrName != "" && len(validation.IsDNS1123Subdomain(defPlrName)) > 0 {
+		return fmt.Errorf(
+			"PolicyDefaults.Placement.PlacementRuleName placement name `%s` is not DNS compliant. See %s",
+			defPlrName,
+			dnsReference,
+		)
+	}
+
+	defPlcmtPlName := p.PolicyDefaults.Placement.PlacementName
+	if defPlcmtPlName != "" && len(validation.IsDNS1123Subdomain(defPlcmtPlName)) > 0 {
+		return fmt.Errorf(
+			"PolicyDefaults.Placement.PlacementName `%s` is not DNS compliant. See %s",
+			defPlcmtPlName,
+			dnsReference,
+		)
+	}
+
+	defPlName := p.PolicyDefaults.Placement.Name
+	if defPlName != "" && len(validation.IsDNS1123Subdomain(defPlName)) > 0 {
+		return fmt.Errorf(
+			"PolicyDefaults.Placement.Name `%s` is not DNS compliant. See %s", defPlName, dnsReference,
+		)
+	}
+
+	if p.PlacementBindingDefaults.Name != "" &&
+		len(validation.IsDNS1123Subdomain(p.PlacementBindingDefaults.Name)) > 0 {
+		return fmt.Errorf(
+			"PlacementBindingDefaults.Name `%s` is not DNS compliant. See %s",
+			p.PlacementBindingDefaults.Name,
+			dnsReference,
+		)
+	}
+
 	defaultPlacementOptions := 0
 	if len(p.PolicyDefaults.Placement.LabelSelector) != 0 || len(p.PolicyDefaults.Placement.ClusterSelectors) != 0 {
 		defaultPlacementOptions++
@@ -685,6 +723,12 @@ func (p *Plugin) assertValidConfig() error {
 			)
 		}
 
+		if len(validation.IsDNS1123Subdomain(policy.Name)) > 0 {
+			return fmt.Errorf(
+				"policy name `%s` is not DNS compliant. See %s", policy.Name, dnsReference,
+			)
+		}
+
 		if seenPlc[policy.Name] {
 			return fmt.Errorf(
 				"each policy must have a unique name set, but found a duplicate name: %s", policy.Name,
@@ -799,6 +843,34 @@ func (p *Plugin) assertValidConfig() error {
 			)
 		}
 
+		// validate placement names are DNS compliant
+		plcPlrName := policy.Placement.PlacementRuleName
+		if plcPlrName != "" && len(validation.IsDNS1123Subdomain(plcPlrName)) > 0 {
+			return fmt.Errorf(
+				"policy.Placement.PlacementRuleName `%s` is not DNS compliant. See %s",
+				plcPlrName,
+				dnsReference,
+			)
+		}
+
+		plcPlcmtPlName := policy.Placement.PlacementName
+		if plcPlcmtPlName != "" && len(validation.IsDNS1123Subdomain(plcPlcmtPlName)) > 0 {
+			return fmt.Errorf(
+				"policy.Placement.PlacementRuleName `%s` is not DNS compliant. See %s",
+				plcPlcmtPlName,
+				dnsReference,
+			)
+		}
+
+		plcPlName := policy.Placement.Name
+		if plcPlName != "" && len(validation.IsDNS1123Subdomain(plcPlName)) > 0 {
+			return fmt.Errorf(
+				"policy.Placement.PlacementRuleName `%s` is not DNS compliant. See %s",
+				plcPlName,
+				dnsReference,
+			)
+		}
+
 		policyPlacementOptions := 0
 		if len(policy.Placement.LabelSelector) != 0 || len(policy.Placement.ClusterSelectors) != 0 {
 			policyPlacementOptions++
@@ -872,6 +944,12 @@ func (p *Plugin) assertValidConfig() error {
 			)
 		}
 
+		if len(validation.IsDNS1123Subdomain(plcset.Name)) > 0 {
+			return fmt.Errorf(
+				"policy set name `%s` is not DNS compliant. See %s", plcset.Name, dnsReference,
+			)
+		}
+
 		if seenPlcset[plcset.Name] {
 			return fmt.Errorf(
 				"each policySet must have a unique name set, but found a duplicate name: %s", plcset.Name,
@@ -900,6 +978,28 @@ func (p *Plugin) assertValidConfig() error {
 			)
 		}
 
+		// validate placement names are DNS compliant
+		plcSetPlrName := plcset.Placement.PlacementRuleName
+		if plcSetPlrName != "" && len(validation.IsDNS1123Subdomain(plcSetPlrName)) > 0 {
+			return fmt.Errorf(
+				"plcset.Placement.PlacementRuleName `%s` is not DNS compliant. See %s", plcSetPlrName, dnsReference,
+			)
+		}
+
+		plcSetPlcmtPlName := plcset.Placement.PlacementName
+		if plcSetPlcmtPlName != "" && len(validation.IsDNS1123Subdomain(plcSetPlcmtPlName)) > 0 {
+			return fmt.Errorf(
+				"plcset.Placement.PlacementName `%s` is not DNS compliant. See %s", plcSetPlcmtPlName, dnsReference,
+			)
+		}
+
+		plcSetPlName := plcset.Placement.Name
+		if plcSetPlName != "" && len(validation.IsDNS1123Subdomain(plcSetPlName)) > 0 {
+			return fmt.Errorf(
+				"plcset.Placement.Name `%s` is not DNS compliant. See %s", plcSetPlName, dnsReference,
+			)
+		}
+
 		policySetPlacementOptions := 0
 		if len(plcset.Placement.LabelSelector) != 0 || len(plcset.Placement.ClusterSelectors) != 0 {
 			policySetPlacementOptions++

internal/plugin_config_test.go

@@ -429,7 +429,7 @@ policies:
   placement:
     clusterSelectors:
       cloud: red hat
-    placementRuleName: plrExistingName
+    placementRuleName: plrexistingname
   manifests:
     - path: %s
 `,
@@ -497,7 +497,7 @@ policies:
   placement:
     labelSelector:
       cloud: red hat
-    placementRuleName: plrExistingName
+    placementRuleName: plrexistingname
   manifests:
     - path: %s
 `,
@@ -565,7 +565,7 @@ policies:
   placement:
     labelSelector:
       cloud: red hat
-    placementName: plExistingName
+    placementName: plexistingname
   manifests:
     - path: %s
 `,
@@ -766,7 +766,7 @@ metadata:
 policyDefaults:
   namespace: my-policies
   placement:
-    placementName: plExistingName
+    placementName: plexistingname
 policies:
 - name: policy-app-config
   placement:
@@ -1231,7 +1231,7 @@ func TestPolicySetConfig(t *testing.T) {
 					{
 						Name: "my-policyset",
 						Placement: types.PlacementConfig{
-							PlacementName:    "plExistingName",
+							PlacementName:    "plexistingname",
 							ClusterSelectors: map[string]string{"cloud": "red hat"},
 						},
 					},
@@ -1263,7 +1263,7 @@ func TestPolicySetConfig(t *testing.T) {
 					{
 						Name: "my-policyset",
 						Placement: types.PlacementConfig{
-							PlacementName: "plExistingName",
+							PlacementName: "plexistingname",
 							LabelSelector: map[string]string{"cloud": "red hat"},
 						},
 					},
@@ -1295,7 +1295,7 @@ func TestPolicySetConfig(t *testing.T) {
 					{
 						Name: "my-policyset",
 						Placement: types.PlacementConfig{
-							PlacementRuleName: "plrExisingName",
+							PlacementRuleName: "plrexisingname",
 							ClusterSelectors:  map[string]string{"cloud": "red hat"},
 						},
 					},
@@ -1327,7 +1327,7 @@ func TestPolicySetConfig(t *testing.T) {
 					{
 						Name: "my-policyset",
 						Placement: types.PlacementConfig{
-							PlacementRuleName: "plrExisingName",
+							PlacementRuleName: "plrexisingname",
 							LabelSelector:     map[string]string{"cloud": "red hat"},
 						},
 					},