Perform full validation of IngressRoute resources to protect from missing CRD validation

[alexbrand]

We rely on the API server to perform validation of IngressRoute resources via the CRD validation implemented in #441

This validation is encoded in the CRD's deployment manifest, but it is possible for a user to deploy the CRD without it.

[stevesloka]

Would this need to be implemented as an admission controller or are you thinking that we perform the validation when Contour sees the object change and update the status then?

[sudeeptoroy]

A wrong ingressroute or httpproxy configuration can pause further processing of ingressroute/httpproxy by contour controller.

Example:

---
apiVersion: contour.heptio.com/v1beta1
kind: IngressRoute
metadata: 
  name: health-check-boom
  namespace: default
spec: 
- routes: 					# wrongly configured routes
    - match: /
      services: 
        - name: s1-health
          port: 80
  virtualhost:
    fqdn: health.bar.com

Once you apply this config you would see contour logging error (reflector.go: 98).
no more ingressroutes will be processed.

recently the entire validation is removed from crd. A min validation is needed.

  validation:
    openAPIV3Schema:
      type: object
      properties:
        spec:
          type: object

please prioritise this issue

[davecheney]

@sudeeptoroy I'm sorry you got bitten by this. The good news is this is fixed in #1731 which will be available in Contour 1.0.0-rc.2 at the end of the week. I'm going to mark this issue as closed as I didn't realise this old issue was a duplicate.