use CEL for CR validation

.gitignore

@@ -22,6 +22,9 @@ testbin/*
 bundle.Dockerfile
 bundle
 
+# generated csv file.
+config/manifests/bases/csi-addons.clusterserviceversion.yaml
+
 # editor and IDE paraphernalia
 .idea
 *.swp

Makefile

@@ -124,10 +124,6 @@ manifests: controller-gen kustomize ## Generate WebhookConfiguration, ClusterRol
 	$(KUSTOMIZE) build config/crd > deploy/controller/crds.yaml
 	$(KUSTOMIZE) build config/rbac > deploy/controller/rbac.yaml
 	$(KUSTOMIZE) build config/manager > deploy/controller/setup-controller.yaml
-	# Disable admission webhooks by default in setup-controller as it need setting up cert managager
-	sed -i 's|enable-admission-webhooks=true|enable-admission-webhooks=false|g' deploy/controller/setup-controller.yaml
-	# generate single yaml which includes crds, rbac, controller, webhooks, certificates
-	$(KUSTOMIZE) build config/default > deploy/controller/install-all-in-one.yaml
 
 # generate the <package-name>.clusterserviceversion.yaml base
 gen-csv-base:

PROJECT

@@ -14,9 +14,6 @@ resources:
   kind: CSIAddonsNode
   path: github.com/csi-addons/kubernetes-csi-addons/apis/csiaddons/v1alpha1
   version: v1alpha1
-  webhooks:
-    validation: true
-    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
@@ -26,9 +23,6 @@ resources:
   kind: ReclaimSpaceJob
   path: github.com/csi-addons/kubernetes-csi-addons/apis/csiaddons/v1alpha1
   version: v1alpha1
-  webhooks:
-    validation: true
-    webhookVersion: v1
 - api:
     crdVersion: v1
   controller: true
@@ -37,18 +31,12 @@ resources:
   kind: NetworkFence
   path: github.com/csi-addons/kubernetes-csi-addons/apis/csiaddons/v1alpha1
   version: v1alpha1
-  webhooks:
-    validation: true
-    webhookVersion: v1
 - controller: true
   domain: openshift.io
   group: csiaddons
   kind: ReclaimSpaceCronJob
   path: github.com/csi-addons/kubernetes-csi-addons/apis/csiaddons/v1alpha1
   version: v1alpha1
-  webhooks:
-    validation: true
-    webhookVersion: v1
 - controller: true
   group: core
   kind: PersistentVolumeClaim
@@ -62,9 +50,6 @@ resources:
   kind: VolumeReplication
   path: github.com/csi-addons/kubernetes-csi-addons/apis/replication.storage/v1alpha1
   version: v1alpha1
-  webhooks:
-    validation: true
-    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
@@ -73,7 +58,4 @@ resources:
   kind: VolumeReplicationClass
   path: github.com/csi-addons/kubernetes-csi-addons/apis/replication.storage/v1alpha1
   version: v1alpha1
-  webhooks:
-    validation: true
-    webhookVersion: v1
 version: "3"

apis/csiaddons/v1alpha1/csiaddonsnode_types.go

@@ -36,6 +36,8 @@ type CSIAddonsNodeDriver struct {
 	// This must be the same name returned by the CSI-Addons GetIdentity()
 	// call for that driver. The name of the driver is in the format:
 	// `example.csi.ceph.com`
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="name is immutable"
 	Name string `json:"name"`
 
 	// EndPoint is url that contains the ip-address to which the CSI-Addons
@@ -44,6 +46,8 @@ type CSIAddonsNodeDriver struct {
 
 	// NodeID is the ID of the node to identify on which node the side-car
 	// is running.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="nodeID is immutable"
 	NodeID string `json:"nodeID"`
 }
 

apis/csiaddons/v1alpha1/networkfence_types.go

@@ -40,20 +40,26 @@ const (
 	FencingOperationResultFailed FencingOperationResult = "Failed"
 )
 
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="secret is immutable"
 // SecretSpec defines the secrets to be used for the network fencing operation.
 type SecretSpec struct {
 	// Name specifies the name of the secret.
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="name is immutable"
 	Name string `json:"name,omitempty"`
 
 	// Namespace specifies the namespace in which the secret
 	// is located.
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="namespace is immutable"
 	Namespace string `json:"namespace,omitempty"`
 }
 
 // NetworkFenceSpec defines the desired state of NetworkFence
 type NetworkFenceSpec struct {
 	// Driver contains  the name of CSI driver.
 	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="driver is immutable"
 	Driver string `json:"driver"`
 
 	// FenceState contains the desired state for the CIDRs
@@ -71,6 +77,7 @@ type NetworkFenceSpec struct {
 	Secret SecretSpec `json:"secret,omitempty"`
 
 	// Parameters is used to pass additional parameters to the CSI driver.
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="parameters are immutable"
 	Parameters map[string]string `json:"parameters,omitempty"`
 }
 

apis/csiaddons/v1alpha1/reclaimspacejob_types.go

@@ -36,6 +36,7 @@ const (
 // performed.
 type TargetSpec struct {
 	// PersistentVolumeClaim specifies the target PersistentVolumeClaim name.
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="persistentVolumeClaim is immutable"
 	PersistentVolumeClaim string `json:"persistentVolumeClaim,omitempty"`
 }