(chore): Add JSONSchema validation for bundle configuration (#2316)

ClusterExtension configuration is now validated using JSONSchema. Configuration
errors (typos, missing required fields, wrong types) are caught
immediately with clear error messages instead of failing during installation.

Assisted-by: Cursor

Author: camilamacedo86

go.mod

@@ -23,6 +23,7 @@ require (
 	github.com/operator-framework/operator-registry v1.61.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/common v0.67.2
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
@@ -192,7 +193,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rubenv/sql-migrate v1.8.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sigstore/fulcio v1.7.1 // indirect

internal/operator-controller/applier/provider.go

@@ -13,7 +13,7 @@ import (
 	"github.com/operator-framework/api/pkg/operators/v1alpha1"
 
 	ocv1 "github.com/operator-framework/operator-controller/api/v1"
-	"github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/bundle"
+	"github.com/operator-framework/operator-controller/internal/operator-controller/config"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/bundle/source"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/render"
 )
@@ -69,19 +69,19 @@ func (r *RegistryV1ManifestProvider) Get(bundleFS fs.FS, ext *ocv1.ClusterExtens
 	}
 
 	if r.IsSingleOwnNamespaceEnabled {
-		bundleConfigBytes := extensionConfigBytes(ext)
-		// treat no config as empty to properly validate the configuration
-		// e.g. ensure that validation catches missing required fields
-		if bundleConfigBytes == nil {
-			bundleConfigBytes = []byte(`{}`)
+		schema, err := rv1.GetConfigSchema()
+		if err != nil {
+			return nil, fmt.Errorf("error getting configuration schema: %w", err)
 		}
-		bundleConfig, err := bundle.UnmarshalConfig(bundleConfigBytes, rv1, ext.Spec.Namespace)
+
+		bundleConfigBytes := extensionConfigBytes(ext)
+		bundleConfig, err := config.UnmarshalConfig(bundleConfigBytes, schema, ext.Spec.Namespace)
 		if err != nil {
-			return nil, fmt.Errorf("invalid bundle configuration: %w", err)
+			return nil, fmt.Errorf("invalid ClusterExtension configuration: %w", err)
 		}
 
-		if bundleConfig != nil && bundleConfig.WatchNamespace != nil {
-			opts = append(opts, render.WithTargetNamespaces(*bundleConfig.WatchNamespace))
+		if watchNS := bundleConfig.GetWatchNamespace(); watchNS != nil {
+			opts = append(opts, render.WithTargetNamespaces(*watchNS))
 		}
 	}
 

internal/operator-controller/applier/provider_test.go

@@ -97,7 +97,7 @@ func Test_RegistryV1ManifestProvider_Integration(t *testing.T) {
 
 		_, err := provider.Get(bundleFS, ext)
 		require.Error(t, err)
-		require.Contains(t, err.Error(), "invalid bundle configuration")
+		require.Contains(t, err.Error(), "invalid ClusterExtension configuration")
 	})
 
 	t.Run("returns rendered manifests", func(t *testing.T) {
@@ -326,7 +326,7 @@ func Test_RegistryV1ManifestProvider_SingleOwnNamespaceSupport(t *testing.T) {
 			},
 		})
 		require.Error(t, err)
-		require.Contains(t, err.Error(), "required field \"watchNamespace\" is missing")
+		require.Contains(t, err.Error(), `required field "watchNamespace" is missing`)
 	})
 
 	t.Run("accepts bundles with {OwnNamespace} install modes when the appropriate configuration is given", func(t *testing.T) {
@@ -371,7 +371,7 @@ func Test_RegistryV1ManifestProvider_SingleOwnNamespaceSupport(t *testing.T) {
 			},
 		})
 		require.Error(t, err)
-		require.Contains(t, err.Error(), "required field \"watchNamespace\" is missing")
+		require.Contains(t, err.Error(), `required field "watchNamespace" is missing`)
 	})
 
 	t.Run("rejects bundles with {OwnNamespace} install modes when watchNamespace is not install namespace", func(t *testing.T) {
@@ -392,7 +392,9 @@ func Test_RegistryV1ManifestProvider_SingleOwnNamespaceSupport(t *testing.T) {
 			},
 		})
 		require.Error(t, err)
-		require.Contains(t, err.Error(), "invalid 'watchNamespace' \"not-install-namespace\": must be install namespace (install-namespace)")
+		require.Contains(t, err.Error(), "invalid ClusterExtension configuration:")
+		require.Contains(t, err.Error(), "watchNamespace must be")
+		require.Contains(t, err.Error(), "install-namespace")
 	})
 
 	t.Run("rejects bundles without AllNamespaces, SingleNamespace, or OwnNamespace install mode support when Single/OwnNamespace install mode support is enabled", func(t *testing.T) {