Merge pull request #643 from stefanprodan/mod-vet-crd-validation

feat(engine): vet resources against their CRD schemas and CEL rules

Author: stefanprodan

AGENTS.md

@@ -47,6 +47,7 @@ The core of Timoni. Turns CUE into Kubernetes objects:
 - `ResourceSet` — the rendered set of objects.
 - `HealthCheck` — extracts the custom health checks a module declares under `timoni: healthChecks:` (the `#HealthCheck`/`#HealthCheckForCondition` CUE schemas) for custom resources that are not kstatus-compliant.
 - `Importer` (`importer.go`) — generates CUE definitions from Kubernetes **CRDs** by converting their OpenAPI v3 schemas (this is what `timoni mod vendor crd` runs, letting module authors use custom resources type-safely).
+- `CRDValidator` (`crd_validator.go`) — validates rendered custom resources with the kube-apiserver admission packages (OpenAPI schema, CEL rules, list uniqueness) against the original CRDs, which the `Importer` embeds in the generated `types_gen.cue` as a hidden `_crd` field and `timoni mod vet` collects from the module imports and output.
 - `fetcher/` — pulls module sources, either `local.go` (filesystem path) or `oci.go` (OCI registry).
 
 ### `internal/reconciler/` — server-side apply

cmd/timoni/mod_vendor_crd.go

@@ -31,7 +31,6 @@ import (
 	ssautil "github.com/fluxcd/pkg/ssa/utils"
 	"github.com/hashicorp/go-cleanhttp"
 	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"sigs.k8s.io/yaml"
 
 	"github.com/stefanprodan/timoni/internal/engine"
@@ -122,10 +121,7 @@ func runVendorCrdCmd(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("parsing CRDs failed: %w", err)
 	}
 	for _, object := range objects {
-		if object.GetKind() == "CustomResourceDefinition" {
-			if err := removeCRDStatusSchema(object); err != nil {
-				return err
-			}
+		if engine.IsCRD(object) {
 			builder.WriteString("---\n")
 			data, err := yaml.Marshal(object)
 			if err != nil {
@@ -213,28 +209,3 @@ func readRemoteCRDManifest(ctx context.Context, client *http.Client, url string,
 
 	return data, nil
 }
-
-// removeCRDStatusSchema removes the read-only status field from each version.
-func removeCRDStatusSchema(crd *unstructured.Unstructured) error {
-	versions, found, err := unstructured.NestedSlice(crd.Object, "spec", "versions")
-	if err != nil {
-		return fmt.Errorf("reading CRD spec.versions failed: %w", err)
-	}
-	if !found {
-		return nil
-	}
-
-	for i := range versions {
-		version, ok := versions[i].(map[string]any)
-		if !ok {
-			return fmt.Errorf("CRD spec.versions[%d] must be an object", i)
-		}
-		unstructured.RemoveNestedField(version, "schema", "openAPIV3Schema", "properties", "status")
-	}
-
-	if err := unstructured.SetNestedSlice(crd.Object, versions, "spec", "versions"); err != nil {
-		return fmt.Errorf("mutating versions in CRD failed: %w", err)
-	}
-
-	return nil
-}

cmd/timoni/mod_vendor_crd_test.go

@@ -31,7 +31,6 @@ import (
 	"github.com/mattn/go-shellwords"
 	. "github.com/onsi/gomega"
 	"github.com/onsi/gomega/types"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 )
 
 func TestReadRemoteCRDManifestAcceptsBodyAtLimit(t *testing.T) {
@@ -131,72 +130,6 @@ func TestReadRemoteCRDManifestRejectsInsecureRedirect(t *testing.T) {
 	g.Expect(err).To(MatchError(ContainSubstring("redirect to insecure HTTP")))
 }
 
-func TestRemoveCRDStatusSchema(t *testing.T) {
-	tests := []struct {
-		name     string
-		versions any
-		wantErr  string
-	}{
-		{
-			name:     "non-object version",
-			versions: []any{"v1"},
-			wantErr:  "spec.versions[0] must be an object",
-		},
-		{
-			name:     "non-list versions",
-			versions: "v1",
-			wantErr:  "reading CRD spec.versions failed",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			g := NewWithT(t)
-			crd := &unstructured.Unstructured{Object: map[string]any{
-				"spec": map[string]any{"versions": tt.versions},
-			}}
-
-			err := removeCRDStatusSchema(crd)
-
-			g.Expect(err).To(MatchError(ContainSubstring(tt.wantErr)))
-		})
-	}
-}
-
-func TestRemoveCRDStatusSchemaPreservesOtherFields(t *testing.T) {
-	g := NewWithT(t)
-	crd := &unstructured.Unstructured{Object: map[string]any{
-		"spec": map[string]any{
-			"versions": []any{
-				map[string]any{
-					"name": "v1",
-					"schema": map[string]any{
-						"openAPIV3Schema": map[string]any{
-							"properties": map[string]any{
-								"spec":   map[string]any{"type": "object"},
-								"status": map[string]any{"type": "object"},
-							},
-						},
-					},
-				},
-			},
-		},
-	}}
-
-	err := removeCRDStatusSchema(crd)
-
-	g.Expect(err).ToNot(HaveOccurred())
-	versions, found, err := unstructured.NestedSlice(crd.Object, "spec", "versions")
-	g.Expect(err).ToNot(HaveOccurred())
-	g.Expect(found).To(BeTrue())
-	version := versions[0].(map[string]any)
-	properties, found, err := unstructured.NestedMap(version, "schema", "openAPIV3Schema", "properties")
-	g.Expect(err).ToNot(HaveOccurred())
-	g.Expect(found).To(BeTrue())
-	g.Expect(properties).To(HaveKey("spec"))
-	g.Expect(properties).ToNot(HaveKey("status"))
-}
-
 func TestVendorCrd(t *testing.T) {
 	// To regenerate the golden files:
 	// make install

cmd/timoni/mod_vet.go

@@ -42,7 +42,9 @@ var vetModCmd = &cobra.Command{
 	Args:    cobra.MaximumNArgs(1),
 	Aliases: []string{"lint"},
 	Short:   "Validate a local module",
-	Long:    `The vet command builds the local module and validates the resulting Kubernetes objects.`,
+	Long: `The vet command builds the local module and validates the resulting Kubernetes objects.
+Custom resources are validated against their CRD schemas and CEL rules,
+taken from the vendored CRD schemas and from the CRDs included in the module.`,
 	Example: `  # validate module using default values
   timoni mod vet
 
@@ -179,9 +181,41 @@ func runVetModCmd(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("build failed, no objects to apply")
 	}
 
+	// Register the CRD schemas vendored in the imported packages first,
+	// so that the CRDs rendered by the module take precedence for the
+	// same kind versions.
+	imports, err := builder.GetImports()
+	if err != nil {
+		return fmt.Errorf("build failed: %w", err)
+	}
+	crdValidator := engine.NewCRDValidator()
+	if err := crdValidator.AddPackages(imports); err != nil {
+		return fmt.Errorf("validation failed: %w", err)
+	}
+	if err := crdValidator.AddCRDs(objects); err != nil {
+		return fmt.Errorf("validation failed: %w", err)
+	}
+
+	invalid := 0
 	for _, object := range objects {
-		log.Info(fmt.Sprintf("%s %s",
-			logger.ColorizeSubject(ssautil.FmtUnstructured(object)), logger.ColorizeInfo("valid resource")))
+		subject := logger.ColorizeSubject(ssautil.FmtUnstructured(object))
+		if !crdValidator.HasSchema(object.GroupVersionKind()) {
+			log.Info(fmt.Sprintf("%s %s", subject, logger.ColorizeInfo("valid resource")))
+			continue
+		}
+
+		if errs := crdValidator.Validate(cmd.Context(), object); len(errs) > 0 {
+			invalid++
+			for _, e := range errs {
+				log.Error(nil, fmt.Sprintf("%s %s", subject, logger.ColorizeError(e)))
+			}
+			continue
+		}
+		log.Info(fmt.Sprintf("%s %s", subject, logger.ColorizeInfo("valid custom resource")))
+	}
+
+	if invalid > 0 {
+		return fmt.Errorf("validation failed, %d invalid custom resource(s)", invalid)
 	}
 
 	images, err := builder.GetContainerImages(buildResult)

cmd/timoni/mod_vet_test.go

@@ -159,3 +159,54 @@ func TestModVetSetNamespaceName(t *testing.T) {
 		g.Expect(err.Error()).To(ContainSubstring("cannot find package"))
 	})
 }
+
+func TestModVetCELRules(t *testing.T) {
+	// The module ships a Widget CRD with CEL rules and vendors the Gadget CRD
+	// under cue.mod/gen. To regenerate the vendored files:
+	// cd cmd/timoni/
+	// timoni mod vendor crd testdata/module-cel -f testdata/module-cel/gadget-crd.yaml
+	modPath := "testdata/module-cel"
+	valuesPath := "testdata/module-cel-values"
+
+	t.Run("vets custom resources against the CEL rules", func(t *testing.T) {
+		g := NewWithT(t)
+		output, err := executeCommand(fmt.Sprintf(
+			"mod vet %s -p main -n default",
+			modPath,
+		))
+		g.Expect(err).ToNot(HaveOccurred())
+
+		g.Expect(output).To(ContainSubstring("CustomResourceDefinition/widgets.testing.timoni.sh valid resource v=0"))
+		g.Expect(output).To(ContainSubstring("Widget/default/default valid custom resource"))
+		g.Expect(output).To(ContainSubstring("Gadget/default/default valid custom resource"))
+		g.Expect(output).To(ContainSubstring("timoni.sh/test-cel valid module"))
+	})
+
+	t.Run("fails for rules of the CRD included in the module", func(t *testing.T) {
+		g := NewWithT(t)
+		output, err := executeCommand(fmt.Sprintf(
+			"mod vet %s -p main -n default --values %s",
+			modPath, valuesPath+"/widget-invalid.cue",
+		))
+		g.Expect(err).To(HaveOccurred())
+		g.Expect(err.Error()).To(ContainSubstring("validation failed, 1 invalid custom resource(s)"))
+
+		g.Expect(output).To(ContainSubstring("Widget/default/default spec: minReplicas must not exceed replicas"))
+		g.Expect(output).To(ContainSubstring("Gadget/default/default valid custom resource"))
+		g.Expect(output).ToNot(ContainSubstring("valid module"))
+	})
+
+	t.Run("fails for rules of the vendored CRD", func(t *testing.T) {
+		g := NewWithT(t)
+		output, err := executeCommand(fmt.Sprintf(
+			"mod vet %s -p main -n default --values %s",
+			modPath, valuesPath+"/gadget-invalid.cue",
+		))
+		g.Expect(err).To(HaveOccurred())
+		g.Expect(err.Error()).To(ContainSubstring("validation failed, 1 invalid custom resource(s)"))
+
+		g.Expect(output).To(ContainSubstring("Gadget/default/default spec: size must be one of small or large"))
+		g.Expect(output).ToNot(ContainSubstring("size is immutable"))
+		g.Expect(output).To(ContainSubstring("Widget/default/default valid custom resource"))
+	})
+}