✨ feature: migrate structural validation to kubebuilder CEL markers (Phase 1)

[Vaishnav88sk]

Summary

This PR implements Phase 1 of the CEL Validation Migration as outlined and approved in Enhancement Proposal #181.

It replaces legacy Go-based structural webhook validation with native Kubernetes +kubebuilder:validation:XValidation CEL markers directly on the Custom Resource structs.

Validations Migrated:

• ManagedCluster: Enforced HTTPS format for Spec.ManagedClusterClientConfigs URLs and regex format for metadata.name.
• ManagedClusterSetBinding: Enforced cross-field parity (metadata.name == spec.clusterSet).
• ManifestWork: Enforced manifests array is not empty.

Note: The corresponding ValidatingAdmissionPolicy additions and FeatureGate operator updates (Phase 2) will be submitted in a follow-up PR to the ocm repository once this API change is merged.

Related issue(s)

Fixes phase 1 of open-cluster-management-io/ocm#1566

Summary by CodeRabbit

• Bug Fixes
  • Added validation requiring manifest lists in add-on templates, manifest works, and replica sets to contain at least one item.
  • Added validation requiring managed cluster client URLs to use HTTPS.
  • Enforced valid managed cluster names with DNS-compatible formatting and a maximum length of 63 characters.
  • Ensured managed cluster set binding names match their referenced cluster set.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Vaishnav88sk
Once this PR has been reviewed and has the lgtm label, please assign jnpacker for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

Changes

The PR adds CRD validation rules for non-empty manifest lists, HTTPS client URLs, DNS-compatible managed cluster names, and matching ManagedClusterSetBinding names.

CRD validation updates

Layer / File(s)	Summary
Non-empty manifest validation work/v1/types.go, work/v1/..., addon/v1alpha1/..., addon/v1beta1/...	Manifest collections in AddOnTemplate, ManifestWork, and ManifestWorkReplicaSet schemas must be present and contain at least one entry.
ManagedCluster name and URL validation cluster/v1/types.go, cluster/v1/0000_00_clusters...yaml	ManagedCluster names must match the lowercase DNS-like pattern and be at most 63 characters; client configuration URLs must use HTTPS.
ManagedClusterSetBinding name validation cluster/v1beta2/types_managedclustersetbinding.go, cluster/v1beta2/0000_01_clusters...yaml	The resource name must equal spec.clusterSet.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• open-cluster-management-io/api#443: Adds the related AddOnTemplate v1beta1 field and schema definitions.

Suggested labels: lgtm, approved

Suggested reviewers: jnpacker, mikeshng

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: migrating validations to kubebuilder CEL markers in Phase 1.
Description check	✅ Passed	The description includes the required Summary and Related issue(s) sections and describes the migrated validations.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cluster/v1/types.go`:
- Around line 86-87: Replace the URL validation marker on the URL field in
cluster/v1/types.go:86-87 with a CEL expression that performs real URL
validation and requires an HTTPS scheme, rejecting malformed values such as
https://. Regenerate
cluster/v1/0000_00_clusters.open-cluster-management.io_managedclusters.crd.yaml:111-113
so its validation rule and message match the updated source marker.

In `@work/v1/types.go`:
- Around line 69-71: Make Manifests required in work/v1/types.go by removing its
optional marker while retaining the non-empty validation. Regenerate the CRDs so
the required-field schema is reflected in
work/v1/0000_00_work.open-cluster-management.io_manifestworks.crd.yaml, both
listed addon/v1alpha1 and addon/v1beta1 AddonTemplates locations, the second
addon/v1beta1 location, and
work/v1alpha1/0000_00_work.open-cluster-management.io_manifestworkreplicasets.crd.yaml;
no other schema changes are needed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: faef0d51-045c-4ee7-8c02-f0ba16262ca3

📥 Commits

Reviewing files that changed from the base of the PR and between 403378b and 22dfdbf.

📒 Files selected for processing (9)

• addon/v1alpha1/0000_03_addon.open-cluster-management.io_addontemplates.crd.yaml
• addon/v1beta1/0000_03_addon.open-cluster-management.io_addontemplates.crd.yaml
• cluster/v1/0000_00_clusters.open-cluster-management.io_managedclusters.crd.yaml
• cluster/v1/types.go
• cluster/v1beta2/0000_01_clusters.open-cluster-management.io_managedclustersetbindings.crd.yaml
• cluster/v1beta2/types_managedclustersetbinding.go
• work/v1/0000_00_work.open-cluster-management.io_manifestworks.crd.yaml
• work/v1/types.go
• work/v1alpha1/0000_00_work.open-cluster-management.io_manifestworkreplicasets.crd.yaml

[mikeshng]

This is an API change that is no longer about using CEL as validation. I wonder if this is truly needed?

[qiujian16]

please add integration tests to test all the validations.