feat(validation): migrate validation to ValidatingAdmissionPolicy

config/default/kustomization.yaml

@@ -16,6 +16,7 @@ bases:
 - ../crd
 - ../rbac
 - ../manager
+- ../validation
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
 # crd/kustomization.yaml
 #- ../webhook

config/validation/kustomization.yaml

@@ -0,0 +1,4 @@
+resources:
+- validation.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization

config/validation/validation.yaml

@@ -0,0 +1,43 @@
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "druid.apache.org"
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+      - apiGroups:   ["druid.apache.org"]
+        apiVersions: ["v1alpha1"]
+        operations:  ["CREATE", "UPDATE"]
+        resources:   ["druids"]
+  validations:
+    - expression: |
+        object.spec.nodes.all(node, node.image != '' || object.spec.image != '')
+      messageExpression: "Object must have image specified either on object level or node level."
+      reason: "Invalid"
+      message: "Image is missing from spec. should be provided on either object level or node level."
+    - expression: |
+        object.spec.nodes.all(node, node.key.matches('[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'))
+      messageExpression: "All node groups must stand with kubernetes standard naming constraints."
+      reason: "Invalid"
+      message: "Node key does not matching kubernetes standard naming constraints."
+    - expression: |
+        object.spec.nodes.all(node, node.kind == 'StatefulSet' && node.volumeClaimTemplates.all(vct, vct.storageClassName == nil))
+      messageExpression: "All node groups' volume claim templates must have storage class specified."
+      reason: "Forbidden"
+      message: "Node group has volume claim template without storage class which is not allowed."
+    - expression: |
+        object.spec.nodes.all(node, node.additionalContainers.all(nac, object.spec.additionalContainers.all(oac, nac.containerName != oac.containerName))) &&
+        object.spec.nodes.all(node, node.additionalContainers.all(nac, node.additionalContainers.all(nac2, nac2.containerName != nac.containerName))) &&
+        object.spec.additionalContainers.all(oac, object.spec.additionalContainers.all(oac2, oac2.containerName != oac.containerName))
+      messageExpression: "All additional containers on all levels must have a unique container name."
+      reason: "Invalid"
+      message: "Node group has at least two additional containers with the same name."
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "druid.apache.org"
+spec:
+  policyName: "druid.apache.org"
+  validationActions: [Deny, Audit]

controllers/druid/handler.go

@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"regexp"
 	"sort"
 	"strconv"
 	"time"
@@ -40,12 +39,6 @@ var logger = logf.Log.WithName("druid_operator_handler")
 
 func deployDruidCluster(ctx context.Context, sdk client.Client, m *v1alpha1.Druid, emitEvents EventEmitter) error {
 
-	if err := verifyDruidSpec(m); err != nil {
-		e := fmt.Errorf("invalid DruidSpec[%s:%s] due to [%s]", m.Kind, m.Name, err.Error())
-		emitEvents.EmitEventGeneric(m, "DruidOperatorInvalidSpec", "", e)
-		return nil
-	}
-
 	allNodeSpecs, err := getAllNodeSpecsInDruidPrescribedOrder(m)
 	if err != nil {
 		e := fmt.Errorf("invalid DruidSpec[%s:%s] due to [%s]", m.Kind, m.Name, err.Error())
@@ -1359,38 +1352,6 @@ func sendEvent(ctx context.Context, sdk client.Client, drd *v1alpha1.Druid, even
 	}
 }
 
-func verifyDruidSpec(drd *v1alpha1.Druid) error {
-	keyValidationRegex, err := regexp.Compile("[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*")
-	if err != nil {
-		return err
-	}
-
-	if err = validateAdditionalContainersSpec(drd); err != nil {
-		return err
-	}
-
-	if err = validateVolumeClaimTemplateSpec(drd); err != nil {
-		return err
-	}
-
-	errorMsg := ""
-	for key, node := range drd.Spec.Nodes {
-		if drd.Spec.Image == "" && node.Image == "" {
-			errorMsg = fmt.Sprintf("%sImage missing from Druid Cluster Spec\n", errorMsg)
-		}
-
-		if !keyValidationRegex.MatchString(key) {
-			errorMsg = fmt.Sprintf("%sNode[%s] Key must match k8s resource name regex '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'", errorMsg, key)
-		}
-	}
-
-	if errorMsg == "" {
-		return nil
-	} else {
-		return fmt.Errorf(errorMsg)
-	}
-}
-
 type keyAndNodeSpec struct {
 	key  string
 	spec v1alpha1.DruidNodeSpec