chore: add CEL validation for BackendRef Group

Signed-off-by: phantooom <xiaorui.zou@gmail.com>
phantooom · Jun 6, 2024 · cce160e · cce160e
1 parent 0907e40
commit cce160e
Show file tree

Hide file tree

Showing 5 changed files with 17 additions and 0 deletions.
diff --git a/api/v1alpha1/accesslogging_types.go b/api/v1alpha1/accesslogging_types.go
@@ -120,6 +120,7 @@ type ALSEnvoyProxyAccessLog struct {
 	// +kubebuilder:validation:MinItems=1
 	// +kubebuilder:validation:MaxItems=1
 	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Service kind.",rule="self.all(f, f.kind == 'Service')"
+	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
 	BackendRefs []BackendRef `json:"backendRefs"`
 	// LogName defines the friendly name of the access log to be returned in
 	// StreamAccessLogsMessage.Identifier. This allows the access log server
@@ -176,6 +177,7 @@ type OpenTelemetryEnvoyProxyAccessLog struct {
 	// +optional
 	// +kubebuilder:validation:MaxItems=1
 	// +kubebuilder:validation:XValidation:message="only support Service kind.",rule="self.all(f, f.kind == 'Service')"
+	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
 	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
 	// Resources is a set of labels that describe the source of a log entry, including envoy node info.
 	// It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/).

diff --git a/api/v1alpha1/ext_auth_types.go b/api/v1alpha1/ext_auth_types.go
@@ -71,6 +71,7 @@ type GRPCExtAuthService struct {
 	// +optional
 	// +kubebuilder:validation:MaxItems=1
 	// +kubebuilder:validation:XValidation:message="only support Service kind.",rule="self.all(f, f.kind == 'Service')"
+	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
 	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
 }
 
@@ -92,6 +93,7 @@ type HTTPExtAuthService struct {
 	// +optional
 	// +kubebuilder:validation:MaxItems=1
 	// +kubebuilder:validation:XValidation:message="only support Service kind.",rule="self.all(f, f.kind == 'Service')"
+	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
 	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
 
 	// Path is the path of the HTTP External Authorization service.

diff --git a/api/v1alpha1/tracing_types.go b/api/v1alpha1/tracing_types.go
@@ -56,6 +56,7 @@ type TracingProvider struct {
 	// +optional
 	// +kubebuilder:validation:MaxItems=1
 	// +kubebuilder:validation:XValidation:message="only support Service kind.",rule="self.all(f, f.kind == 'Service')"
+	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
 	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
 }
 

diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -10356,6 +10356,9 @@ spec:
                                         - message: BackendRefs only supports Service
                                             kind.
                                           rule: self.all(f, f.kind == 'Service')
+                                        - message: BackendRefs only supports Core
+                                            group.
+                                          rule: self.all(f, f.group == '')
                                       http:
                                         description: HTTP defines additional configuration
                                           specific to HTTP access logs.
@@ -10505,6 +10508,9 @@ spec:
                                         x-kubernetes-validations:
                                         - message: only support Service kind.
                                           rule: self.all(f, f.kind == 'Service')
+                                        - message: BackendRefs only supports Core
+                                            group.
+                                          rule: self.all(f, f.group == '')
                                       host:
                                         description: |-
                                           Host define the extension service hostname.
@@ -10927,6 +10933,8 @@ spec:
                             x-kubernetes-validations:
                             - message: only support Service kind.
                               rule: self.all(f, f.kind == 'Service')
+                            - message: BackendRefs only supports Core group.
+                              rule: self.all(f, f.group == '')
                           host:
                             description: |-
                               Host define the provider service hostname.

diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -424,6 +424,8 @@ spec:
                         x-kubernetes-validations:
                         - message: only support Service kind.
                           rule: self.all(f, f.kind == 'Service')
+                        - message: BackendRefs only supports Core group.
+                          rule: self.all(f, f.group == '')
                     type: object
                     x-kubernetes-validations:
                     - message: backendRef or backendRefs needs to be set
@@ -618,6 +620,8 @@ spec:
                         x-kubernetes-validations:
                         - message: only support Service kind.
                           rule: self.all(f, f.kind == 'Service')
+                        - message: BackendRefs only supports Core group.
+                          rule: self.all(f, f.group == '')
                       headersToBackend:
                         description: |-
                           HeadersToBackend are the authorization response headers that will be added