Add CEL rules to AdmissionCheck

apis/kueue/v1beta1/admissioncheck_types.go

@@ -50,6 +50,8 @@ type AdmissionCheckSpec struct {
 	// controllerName is name of the controller which will actually perform
 	// the checks. This is the name with which controller identifies with,
 	// not necessarily a K8S Pod or Deployment name. Cannot be empty.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="field is immutable"
 	ControllerName string `json:"controllerName"`
 
 	// RetryDelayMinutes specifies how long to keep the workload suspended
@@ -67,10 +69,16 @@ type AdmissionCheckSpec struct {
 
 type AdmissionCheckParametersReference struct {
 	// ApiGroup is the group for the resource being referenced.
+	// +kubebuilder:validation:MaxLength=253
+	// +kubebuilder:validation:Pattern="^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
 	APIGroup string `json:"apiGroup"`
 	// Kind is the type of the resource being referenced.
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern="^(?i)[a-z]([-a-z0-9]*[a-z0-9])?$"
 	Kind string `json:"kind"`
 	// Name is the name of the resource being referenced.
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern="^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
 	Name string `json:"name"`
 }
 

charts/kueue/templates/crd/kueue.x-k8s.io_admissionchecks.yaml

@@ -60,18 +60,27 @@ spec:
                   the checks. This is the name with which controller identifies with,
                   not necessarily a K8S Pod or Deployment name. Cannot be empty.
                 type: string
+                x-kubernetes-validations:
+                - message: field is immutable
+                  rule: self == oldSelf
               parameters:
                 description: Parameters identifies the resource providing additional
                   check parameters.
                 properties:
                   apiGroup:
                     description: ApiGroup is the group for the resource being referenced.
+                    maxLength: 253
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                   kind:
                     description: Kind is the type of the resource being referenced.
+                    maxLength: 63
+                    pattern: ^(?i)[a-z]([-a-z0-9]*[a-z0-9])?$
                     type: string
                   name:
                     description: Name is the name of the resource being referenced.
+                    maxLength: 63
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                     type: string
                 required:
                 - apiGroup

charts/kueue/templates/webhook/webhook.yaml

@@ -540,26 +540,6 @@ webhooks:
         resources:
           - rayjobs
     sideEffects: None
-  - admissionReviewVersions:
-      - v1
-    clientConfig:
-      service:
-        name: '{{ include "kueue.fullname" . }}-webhook-service'
-        namespace: '{{ .Release.Namespace }}'
-        path: /validate-kueue-x-k8s-io-v1beta1-admissioncheck
-    failurePolicy: Fail
-    name: vadmissioncheck.kb.io
-    rules:
-      - apiGroups:
-          - kueue.x-k8s.io
-        apiVersions:
-          - v1beta1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - admissionchecks
-    sideEffects: None
   - admissionReviewVersions:
       - v1
     clientConfig:

config/components/crd/bases/kueue.x-k8s.io_admissionchecks.yaml

@@ -45,18 +45,27 @@ spec:
                   the checks. This is the name with which controller identifies with,
                   not necessarily a K8S Pod or Deployment name. Cannot be empty.
                 type: string
+                x-kubernetes-validations:
+                - message: field is immutable
+                  rule: self == oldSelf
               parameters:
                 description: Parameters identifies the resource providing additional
                   check parameters.
                 properties:
                   apiGroup:
                     description: ApiGroup is the group for the resource being referenced.
+                    maxLength: 253
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                   kind:
                     description: Kind is the type of the resource being referenced.
+                    maxLength: 63
+                    pattern: ^(?i)[a-z]([-a-z0-9]*[a-z0-9])?$
                     type: string
                   name:
                     description: Name is the name of the resource being referenced.
+                    maxLength: 63
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                     type: string
                 required:
                 - apiGroup

config/components/webhook/manifests.yaml

@@ -496,26 +496,6 @@ webhooks:
     resources:
     - rayjobs
   sideEffects: None
-- admissionReviewVersions:
-  - v1
-  clientConfig:
-    service:
-      name: webhook-service
-      namespace: system
-      path: /validate-kueue-x-k8s-io-v1beta1-admissioncheck
-  failurePolicy: Fail
-  name: vadmissioncheck.kb.io
-  rules:
-  - apiGroups:
-    - kueue.x-k8s.io
-    apiVersions:
-    - v1beta1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - admissionchecks
-  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig: