validate: Recognize Kubernetes built-in resources

go.mod

@@ -48,6 +48,7 @@ require (
 	k8s.io/apiserver v0.35.1
 	k8s.io/cli-runtime v0.35.1
 	k8s.io/client-go v0.35.3
+	k8s.io/kube-aggregator v0.35.1
 	k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4
 	k8s.io/metrics v0.35.1
 	k8s.io/utils v0.0.0-20260319190234-28399d86e0b5

go.sum

@@ -1104,6 +1104,8 @@ k8s.io/gengo/v2 v2.0.0-20251215205346-5ee0d033ba5b h1:0YkdvW3rX2vaBWsqCGZAekxPRw
 k8s.io/gengo/v2 v2.0.0-20251215205346-5ee0d033ba5b/go.mod h1:yvyl3l9E+UxlqOMUULdKTAYB0rEhsmjr7+2Vb/1pCSo=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-aggregator v0.35.1 h1:LN+btMJ3yp7biqVgT/0LF6SKIKLyfPU0R+JJ1mycs2I=
+k8s.io/kube-aggregator v0.35.1/go.mod h1:HQSjPQfOFRzcv7biQ7jV3cEfKHG+bczpLCfh4QfvxZU=
 k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 h1:HhDfevmPS+OalTjQRKbTHppRIz01AWi8s45TMXStgYY=
 k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
 k8s.io/kubectl v0.35.1 h1:zP3Er8C5i1dcAFUMh9Eva0kVvZHptXIn/+8NtRWMxwg=

pkg/validate/validate.go

@@ -18,6 +18,7 @@ package validate
 
 import (
 	"context"
+	"encoding/json"
 
 	ext "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions"
 	extv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@@ -26,14 +27,46 @@ import (
 	structuraldefaulting "k8s.io/apiextensions-apiserver/pkg/apiserver/schema/defaulting"
 	"k8s.io/apiextensions-apiserver/pkg/apiserver/validation"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
 	runtimeschema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializerjson "k8s.io/apimachinery/pkg/runtime/serializer/json"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	celconfig "k8s.io/apiserver/pkg/apis/cel"
+	kubescheme "k8s.io/client-go/kubernetes/scheme"
+	apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
 
 	"github.com/crossplane/crossplane-runtime/v2/pkg/errors"
 	"github.com/crossplane/crossplane-runtime/v2/pkg/xcrd"
 )
 
+type kubernetesResourceValidator struct {
+	scheme     *runtime.Scheme
+	serializer *serializerjson.Serializer
+}
+
+func newKubernetesResourceValidator() (*kubernetesResourceValidator, error) {
+	s := runtime.NewScheme()
+	if err := kubescheme.AddToScheme(s); err != nil {
+		return nil, errors.Wrap(err, "cannot register Kubernetes types")
+	}
+	if err := extv1.AddToScheme(s); err != nil {
+		return nil, errors.Wrap(err, "cannot register apiextensions types")
+	}
+	if err := apiregistrationv1.AddToScheme(s); err != nil {
+		return nil, errors.Wrap(err, "cannot register API registration types")
+	}
+
+	return &kubernetesResourceValidator{
+		scheme: s,
+		serializer: serializerjson.NewSerializerWithOptions(
+			serializerjson.DefaultMetaFactory,
+			s,
+			s,
+			serializerjson.SerializerOptions{Strict: true},
+		),
+	}, nil
+}
+
 // SchemaValidate performs schema validation and returns structured results.
 //
 // This is the processing-only API: no I/O is performed, allowing programmatic
@@ -50,12 +83,16 @@ func SchemaValidate(ctx context.Context, resources []*unstructured.Unstructured,
 	if err != nil {
 		return nil, errors.Wrap(err, "cannot create schema validators")
 	}
+	kubernetesValidator, err := newKubernetesResourceValidator()
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot create Kubernetes resource validator")
+	}
 
 	result := &ValidationResult{
 		Resources: make([]ResourceValidationResult, 0, len(resources)),
 	}
 	for _, r := range resources {
-		result.Resources = append(result.Resources, validateResource(ctx, r, schemaValidators, structurals, crds))
+		result.Resources = append(result.Resources, validateResource(ctx, r, schemaValidators, structurals, crds, kubernetesValidator))
 	}
 	result.Summary = computeSummary(result.Resources)
 	return result, nil
@@ -75,6 +112,7 @@ func validateResource(
 	schemaValidators map[runtimeschema.GroupVersionKind]*validation.SchemaValidator,
 	structurals map[runtimeschema.GroupVersionKind]*schema.Structural,
 	crds []*extv1.CustomResourceDefinition,
+	kubernetesValidator *kubernetesResourceValidator,
 ) ResourceValidationResult {
 	gvk := in.GetObjectKind().GroupVersionKind()
 	rvr := ResourceValidationResult{
@@ -86,6 +124,11 @@ func validateResource(
 
 	sv, ok := schemaValidators[gvk]
 	if !ok {
+		if validationErrors, recognized := kubernetesValidator.validate(in); recognized {
+			rvr.Errors = validationErrors
+			rvr.Status = statusFromErrors(validationErrors)
+			return rvr
+		}
 		rvr.Status = ValidationStatusMissingSchema
 		return rvr
 	}
@@ -127,6 +170,40 @@ func validateResource(
 	return rvr
 }
 
+// validate strictly decodes resources registered in the
+// Kubernetes, apiextensions, and API registration schemes. Strict decoding
+// catches unknown fields and JSON values that cannot populate their typed Go
+// fields. It does not perform API-server admission or semantic validation.
+func (v *kubernetesResourceValidator) validate(in *unstructured.Unstructured) ([]FieldValidationError, bool) {
+	gvk := in.GroupVersionKind()
+	obj, err := v.scheme.New(gvk)
+	if err != nil {
+		return nil, false
+	}
+
+	data, err := json.Marshal(in.Object)
+	if err == nil {
+		_, _, err = v.serializer.Decode(data, &gvk, obj)
+	}
+	if err == nil {
+		return nil, true
+	}
+
+	decodeErrors := []error{err}
+	if strictErr, ok := runtime.AsStrictDecodingError(err); ok {
+		decodeErrors = strictErr.Errors()
+	}
+
+	validationErrors := make([]FieldValidationError, 0, len(decodeErrors))
+	for _, decodeErr := range decodeErrors {
+		validationErrors = append(validationErrors, FieldValidationError{
+			Type:    FieldErrorTypeSchema,
+			Message: decodeErr.Error(),
+		})
+	}
+	return validationErrors, true
+}
+
 // ResultError returns an error summarizing the outcome of validation, or nil
 // if validation succeeded. This preserves the historical error semantics of
 // SchemaValidation for programmatic consumers who want a boolean pass/fail.

pkg/validate/validate_test.go

@@ -167,6 +167,38 @@ func TestSchemaValidate(t *testing.T) {
 		"kind":       "Unknown",
 		"metadata":   map[string]any{"name": "no-crd"},
 	}}
+	kubernetesCoreResource := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "v1",
+		"kind":       "Secret",
+		"metadata":   map[string]any{"name": "connection-details"},
+	}}
+	kubernetesGroupedResource := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata":   map[string]any{"name": "workload"},
+	}}
+	kubernetesCRDResource := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "apiextensions.k8s.io/v1",
+		"kind":       "CustomResourceDefinition",
+		"metadata":   map[string]any{"name": "widgets.example.org"},
+	}}
+	kubernetesAPIServiceResource := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "apiregistration.k8s.io/v1",
+		"kind":       "APIService",
+		"metadata":   map[string]any{"name": "v1.example.org"},
+	}}
+	invalidKubernetesUnknownFieldResource := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "v1",
+		"kind":       "Secret",
+		"metadata":   map[string]any{"name": "bad-field"},
+		"spec":       map[string]any{"unexpected": true},
+	}}
+	invalidKubernetesTypeResource := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "apps/v1",
+		"kind":       "Deployment",
+		"metadata":   map[string]any{"name": "bad-type"},
+		"spec":       map[string]any{"replicas": "many"},
+	}}
 	unknownFieldResource := &unstructured.Unstructured{Object: map[string]any{
 		"apiVersion": "test.org/v1alpha1",
 		"kind":       "Test",
@@ -260,6 +292,48 @@ func TestSchemaValidate(t *testing.T) {
 				perRes:  []expect{{status: ValidationStatusMissingSchema}},
 			},
 		},
+		"KubernetesBuiltIn": {
+			reason: "Built-in Kubernetes, CRD, and APIService resources should be strictly decoded without requiring user-supplied CRD schemas.",
+			args: args{
+				resources: []*unstructured.Unstructured{
+					kubernetesCoreResource,
+					kubernetesGroupedResource,
+					kubernetesCRDResource,
+					kubernetesAPIServiceResource,
+				},
+			},
+			want: want{
+				summary: ValidationSummary{Total: 4, Valid: 4},
+				perRes: []expect{
+					{status: ValidationStatusValid},
+					{status: ValidationStatusValid},
+					{status: ValidationStatusValid},
+					{status: ValidationStatusValid},
+				},
+			},
+		},
+		"KubernetesBuiltInInvalid": {
+			reason: "Built-in Kubernetes resources with unknown fields or mistyped values should be Invalid instead of bypassing validation.",
+			args: args{
+				resources: []*unstructured.Unstructured{
+					invalidKubernetesUnknownFieldResource,
+					invalidKubernetesTypeResource,
+				},
+			},
+			want: want{
+				summary: ValidationSummary{Total: 2, Invalid: 2},
+				perRes: []expect{
+					{
+						status: ValidationStatusInvalid,
+						errors: []FieldValidationError{{Type: FieldErrorTypeSchema}},
+					},
+					{
+						status: ValidationStatusInvalid,
+						errors: []FieldValidationError{{Type: FieldErrorTypeSchema}},
+					},
+				},
+			},
+		},
 		"UnknownField": {
 			reason: "A resource with a field not declared in the schema should surface an unknownField error on the offending field path.",
 			args: args{