Adopt CRD native validation

[howardjohn]

Part of istio/istio#46151.

This is the first PR ramping up our CRD native validation. The intent here is to provide the same validation but without a webhook dependency.

To keep things small and start in a low-risk API, this PR introduces validation only for WasmPlugin. Most of this is pretty straightforward; the Go webhook validation logic is 1:1 mapped into native CRD concepts.

Testing this change (and future) ones has three levels:

• In this PR, introduced a new test suite. There is a big folder of CR yamls, and each one can declare itself valid or invalid. Each of these is run through validation and asserts the results.
• In a followup PR in istio/istio, the same test inputs are tested comparing the webook response to the CRD validation response. This ensures we are not accidentally too strict or too lenient in our CRD validation; our goal is to be identical.
• In addition to ^, a fuzz test will be added that does the same but with randomized inputs. This will give us pretty solid evidence that this change is safe.

blocked by: istio/tools#2687
blocked by: me running the fuzzer a bit locally to get confidence

[istio-testing]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[costinm]

+1 on the change - but I think we are over-complicating things. Great to have a test suite, but I don't think it needs to match 100% what the current validator does. If we can convert any tests the validator had to the new suite - it should be sufficient.

[hzxuzhonghu]

How does cue intergrate with kubebuilder

[howardjohn]

We no longer use Cue because it did not support this

…

On Thu, Oct 12, 2023, 6:26 PM Zhonghu Xu ***@***.***> wrote: ***@***.**** commented on this pull request. How does cue intergrate with kubebuilder — Reply to this email directly, view it on GitHub <#2951 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEYGXNUVNIOMGEJ4Y6ITMDX7CKCTANCNFSM6AAAAAA5WNOCGE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[ericvn]

Nit: sometimes the min is before the max, sometimes its after.