Skip to content

Use regex instead of format help for KMS secret name validation #2966

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JoelSpeed wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Use regex instead of format help for KMS secret name validation #2966

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e5a6b6c
Use regex instead of format help for KMS secret name validation
JoelSpeed Jul 31, 2026
eeeccce
Ingress ComponentRoute labels should use regex instead of format CEL …
JoelSpeed Aug 3, 2026
5289f85
Authentication config must not use format validations
JoelSpeed Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion config/v1/tests/ingresses.config.openshift.io/IngressComponentRouteLabels.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,7 +230,7 @@ tests:
hostname: console.example.com
labels:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa: value
expectedError: "label keys must be valid qualified names, consisting of an optional DNS subdomain prefix"
expectedError: "label keys must be between 1 and 63 characters in length"
- name: Should reject componentRoutes with label value starting with dash
initial: |
apiVersion: config.openshift.io/v1
Expand Down
6 changes: 3 additions & 3 deletions config/v1/types_authentication.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1087,7 +1087,7 @@ type SourceURL struct {
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=259
// +kubebuilder:validation:XValidation:rule="isURL('https://'+self)",message="hostname must be a valid hostname"
// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self.split(':')[0]).hasValue()",message="hostname before port must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'"
// +kubebuilder:validation:XValidation:rule="self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')",message="hostname before port must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'"
// +kubebuilder:validation:XValidation:rule="self.split(':').size() > 1 ? int(self.split(':')[1]) <= 65535 : true",message="port must not exceed 65535"
Hostname string `json:"hostname,omitempty"`

Expand Down Expand Up @@ -1194,7 +1194,7 @@ type ExternalSourceCertificateAuthorityConfigMapReference struct {
// +required
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=253
// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'"
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'"
Name string `json:"name,omitempty"`
}

Expand All @@ -1211,6 +1211,6 @@ type ClientSecretSecretReference struct {
// +required
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=253
// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'"
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')",message="name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'"
Name string `json:"name,omitempty"`
}
6 changes: 4 additions & 2 deletions config/v1/types_ingress.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,8 @@ const (
// alphanumeric characters, '-', '_', or '.', starting and ending with
// an alphanumeric character.
// +kubebuilder:validation:MaxLength=63
// +kubebuilder:validation:XValidation:rule="!format.labelValue().validate(self).hasValue()",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)"
// +kubebuilder:validation:MinLength=0
// +kubebuilder:validation:XValidation:rule="self == \"\" || self.matches('^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$')",message="label values must be valid Kubernetes label values (at most 63 characters, alphanumeric, '-', '_', or '.', must start and end with alphanumeric)"
type LabelValue string

// ConsumingUser is an alias for string which we add validation to. Currently only service accounts are supported.
Expand Down Expand Up @@ -278,7 +279,8 @@ type ComponentRouteSpec struct {
// +mapType=granular
// +kubebuilder:validation:MinProperties=1
// +kubebuilder:validation:MaxProperties=8
// +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character"
// +kubebuilder:validation:XValidation:rule="self.all(key, key.size() <= 63 && key.size() > 0)",message="label keys must be between 1 and 63 characters in length"
// +kubebuilder:validation:XValidation:rule="self.all(key, key.matches('^([a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*\\\\/)?[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$') && key.size() <= 253)",message="label keys must be valid qualified names, consisting of an optional DNS subdomain prefix of up to 253 characters followed by a slash and a name segment of 1-63 characters, that consists only of alphanumeric characters, dashes, underscores, and dots, and must start and end with an alphanumeric character"
Comment thread
coderabbitai[bot] marked this conversation as resolved.
// +kubebuilder:validation:XValidation:rule="self.all(key, !key.startsWith('kubernetes.io/') && !key.startsWith('k8s.io/') && !key.startsWith('openshift.io/'))",message="kubernetes.io/, k8s.io/, and openshift.io/ prefixed label keys are reserved and may not be used"
Labels map[string]LabelValue `json:"labels,omitempty"`
}
Expand Down
6 changes: 3 additions & 3 deletions config/v1/types_kmsencryption.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ type VaultSecretReference struct {
//
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=253
// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +required
Name string `json:"name,omitempty"`
}
Expand All @@ -76,7 +76,7 @@ type VaultConfigMapReference struct {
//
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=253
// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +required
Name string `json:"name,omitempty"`
}
Expand Down Expand Up @@ -300,7 +300,7 @@ type VaultTLSConfig struct {
//
// +kubebuilder:validation:MaxLength=253
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character"
// +optional
ServerName string `json:"serverName,omitempty"`
}
6 changes: 3 additions & 3 deletions ...zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with
an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -307,7 +307,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with an
alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand All @@ -327,7 +327,7 @@ spec:
contain no more than 253 characters, contain only
lowercase alphanumeric characters, ''-'' or ''.'',
and start and end with an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
type: object
vaultAddress:
description: |-
Expand Down
6 changes: 3 additions & 3 deletions ...enerated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with
an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -307,7 +307,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with an
alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand All @@ -327,7 +327,7 @@ spec:
contain no more than 253 characters, contain only
lowercase alphanumeric characters, ''-'' or ''.'',
and start and end with an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
type: object
vaultAddress:
description: |-
Expand Down
6 changes: 3 additions & 3 deletions ...nerated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with
an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -307,7 +307,7 @@ spec:
contain only lowercase alphanumeric characters,
''-'' or ''.'', and start and end with an
alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand All @@ -327,7 +327,7 @@ spec:
contain no more than 253 characters, contain only
lowercase alphanumeric characters, ''-'' or ''.'',
and start and end with an alphanumeric character'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$')
type: object
vaultAddress:
description: |-
Expand Down
8 changes: 4 additions & 4 deletions ...nerated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -518,7 +518,7 @@ spec:
lowercase alphanumeric character, and
must only contain lowercase alphanumeric
characters, '-' or '.'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -583,7 +583,7 @@ spec:
a lowercase alphanumeric character,
and must only contain lowercase alphanumeric
characters, '-' or '.'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -791,7 +791,7 @@ spec:
alphanumeric character, and must only contain
lowercase alphanumeric characters, '-' or
'.'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -827,7 +827,7 @@ spec:
with a lowercase alphanumeric character, and must
only contain lowercase alphanumeric characters,
'-' or '.'
rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()'
rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')
- message: port must not exceed 65535
rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1])
<= 65535 : true'
Expand Down
8 changes: 4 additions & 4 deletions ...ted.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -518,7 +518,7 @@ spec:
lowercase alphanumeric character, and
must only contain lowercase alphanumeric
characters, '-' or '.'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -583,7 +583,7 @@ spec:
a lowercase alphanumeric character,
and must only contain lowercase alphanumeric
characters, '-' or '.'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -791,7 +791,7 @@ spec:
alphanumeric character, and must only contain
lowercase alphanumeric characters, '-' or
'.'
rule: '!format.dns1123Subdomain().validate(self).hasValue()'
rule: self.matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')
required:
- name
type: object
Expand Down Expand Up @@ -827,7 +827,7 @@ spec:
with a lowercase alphanumeric character, and must
only contain lowercase alphanumeric characters,
'-' or '.'
rule: '!format.dns1123Subdomain().validate(self.split('':'')[0]).hasValue()'
rule: self.split(':')[0].matches('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')
- message: port must not exceed 65535
rule: 'self.split('':'').size() > 1 ? int(self.split('':'')[1])
<= 65535 : true'
Expand Down
Loading