Skip to content

Treat x-validations as a map when merging for manifest merge #2896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JoelSpeed wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Treat x-validations as a map when merging for manifest merge #2896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bae3466
Treat x-validations as a map when merging for manifest merge
JoelSpeed Jun 19, 2026
e7d762d
Update generated manifests
JoelSpeed Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions ...g/v1/zz_generated.crd-manifests/0000_10_config-operator_01_dnses-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,9 @@ spec:
<role-name> is the IAM role name.
type: string
x-kubernetes-validations:
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
Comment on lines +82 to 87

@tthvo tthvo Jun 20, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AFAIK, the intention is that aws-eusc is only allowed behind gate. Thus, the partition regex is defined based on whether AWSEuropeanSovereignCloudInstall feature gate is enabled 👇

api/config/v1/types_dns.go

Lines 143 to 146 in 5346161

// +openshift:validation:FeatureGateAwareXValidation:featureGate="",rule=`matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')`,message=`privateZoneIAMRole must be a valid AWS IAM role ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>`
// +openshift:validation:FeatureGateAwareXValidation:featureGate=AWSEuropeanSovereignCloudInstall,rule=`matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')`,message=`privateZoneIAMRole must be a valid AWS IAM role ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>`
// +optional
PrivateZoneIAMRole string `json:"privateZoneIAMRole"`

That is the 2 validation entries should be mutually exclusive (same KMS key ARN). I remember we discussed it in #2708 (comment) and #2770.

Any ideas how to achieve the same thing with the new tooling change here 🤔?

Expand Down
3 changes: 3 additions & 0 deletions .../zz_generated.crd-manifests/0000_10_config-operator_01_dnses-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,9 @@ spec:
<role-name> is the IAM role name.
type: string
x-kubernetes-validations:
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
Expand Down
3 changes: 3 additions & 0 deletions ...zz_generated.crd-manifests/0000_10_config-operator_01_dnses-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,9 @@ spec:
<role-name> is the IAM role name.
type: string
x-kubernetes-validations:
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
Expand Down
6 changes: 6 additions & 0 deletions ...nerated.crd-manifests/0000_10_config-operator_01_infrastructures-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1084,6 +1084,9 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once set
rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
&& size(self) < 2 : true'
- message: Cannot add and remove vCenters at the same time
rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y,
y.server == x.server)) : true'
Expand All @@ -1100,6 +1103,9 @@ spec:
rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
type: object
x-kubernetes-validations:
- message: vcenters can have at most 1 item when configured post-install
rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? (has(self.vsphere.vcenters)
&& size(self.vsphere.vcenters) < 2) : true'
- message: vcenters is required once set and cannot be removed
rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
: true'
Expand Down
3 changes: 3 additions & 0 deletions ...v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-Default.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1018,6 +1018,9 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once set
rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
&& size(self) < 2 : true'
- message: vcenters must have unique server values
rule: self.all(x, self.exists_one(y, y.server == x.server))
type: object
Expand Down
6 changes: 6 additions & 0 deletions ...ted.crd-manifests/0000_10_config-operator_01_infrastructures-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1084,6 +1084,9 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once set
rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
&& size(self) < 2 : true'
- message: Cannot add and remove vCenters at the same time
rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y,
y.server == x.server)) : true'
Expand All @@ -1100,6 +1103,9 @@ spec:
rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
type: object
x-kubernetes-validations:
- message: vcenters can have at most 1 item when configured post-install
rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? (has(self.vsphere.vcenters)
&& size(self.vsphere.vcenters) < 2) : true'
- message: vcenters is required once set and cannot be removed
rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
: true'
Expand Down
3 changes: 3 additions & 0 deletions config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_infrastructures-OKD.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1018,6 +1018,9 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once set
rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
&& size(self) < 2 : true'
- message: vcenters must have unique server values
rule: self.all(x, self.exists_one(y, y.server == x.server))
type: object
Expand Down
6 changes: 6 additions & 0 deletions ...ed.crd-manifests/0000_10_config-operator_01_infrastructures-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1084,6 +1084,9 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once set
rule: 'size(self) != size(oldSelf) ? size(oldSelf) == 0
&& size(self) < 2 : true'
- message: Cannot add and remove vCenters at the same time
rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x, self.exists(y,
y.server == x.server)) : true'
Expand All @@ -1100,6 +1103,9 @@ spec:
rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
type: object
x-kubernetes-validations:
- message: vcenters can have at most 1 item when configured post-install
rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? (has(self.vsphere.vcenters)
&& size(self.vsphere.vcenters) < 2) : true'
- message: vcenters is required once set and cannot be removed
rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
: true'
Expand Down
11 changes: 11 additions & 0 deletions ...erated.crd-manifests/0000_80_machine-config_01_controllerconfigs-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,9 @@ spec:
<role-name> is the IAM role name.
type: string
x-kubernetes-validations:
- message: 'privateZoneIAMRole must be a valid AWS
IAM role ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
- message: 'privateZoneIAMRole must be a valid AWS
IAM role ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
Expand Down Expand Up @@ -1373,6 +1376,10 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once
set
rule: 'size(self) != size(oldSelf) ? size(oldSelf)
== 0 && size(self) < 2 : true'
- message: Cannot add and remove vCenters at the same
time
rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x,
Expand All @@ -1393,6 +1400,10 @@ spec:
rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
type: object
x-kubernetes-validations:
- message: vcenters can have at most 1 item when configured
post-install
rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? (has(self.vsphere.vcenters)
&& size(self.vsphere.vcenters) < 2) : true'
- message: vcenters is required once set and cannot be removed
rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
: true'
Expand Down
4 changes: 4 additions & 0 deletions ...1/zz_generated.crd-manifests/0000_80_machine-config_01_controllerconfigs-Default.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1305,6 +1305,10 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once
set
rule: 'size(self) != size(oldSelf) ? size(oldSelf)
== 0 && size(self) < 2 : true'
- message: vcenters must have unique server values
rule: self.all(x, self.exists_one(y, y.server ==
x.server))
Expand Down
11 changes: 11 additions & 0 deletions ...ed.crd-manifests/0000_80_machine-config_01_controllerconfigs-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,9 @@ spec:
<role-name> is the IAM role name.
type: string
x-kubernetes-validations:
- message: 'privateZoneIAMRole must be a valid AWS
IAM role ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
- message: 'privateZoneIAMRole must be a valid AWS
IAM role ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
Expand Down Expand Up @@ -1373,6 +1376,10 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once
set
rule: 'size(self) != size(oldSelf) ? size(oldSelf)
== 0 && size(self) < 2 : true'
- message: Cannot add and remove vCenters at the same
time
rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x,
Expand All @@ -1393,6 +1400,10 @@ spec:
rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
type: object
x-kubernetes-validations:
- message: vcenters can have at most 1 item when configured
post-install
rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? (has(self.vsphere.vcenters)
&& size(self.vsphere.vcenters) < 2) : true'
- message: vcenters is required once set and cannot be removed
rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
: true'
Expand Down
4 changes: 4 additions & 0 deletions ...on/v1/zz_generated.crd-manifests/0000_80_machine-config_01_controllerconfigs-OKD.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1305,6 +1305,10 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once
set
rule: 'size(self) != size(oldSelf) ? size(oldSelf)
== 0 && size(self) < 2 : true'
- message: vcenters must have unique server values
rule: self.all(x, self.exists_one(y, y.server ==
x.server))
Expand Down
11 changes: 11 additions & 0 deletions ...d.crd-manifests/0000_80_machine-config_01_controllerconfigs-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,9 @@ spec:
<role-name> is the IAM role name.
type: string
x-kubernetes-validations:
- message: 'privateZoneIAMRole must be a valid AWS
IAM role ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
- message: 'privateZoneIAMRole must be a valid AWS
IAM role ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
Expand Down Expand Up @@ -1373,6 +1376,10 @@ spec:
type: array
x-kubernetes-list-type: atomic
x-kubernetes-validations:
- message: vcenters cannot be added or removed once
set
rule: 'size(self) != size(oldSelf) ? size(oldSelf)
== 0 && size(self) < 2 : true'
- message: Cannot add and remove vCenters at the same
time
rule: 'size(self) >= size(oldSelf) ? oldSelf.all(x,
Expand All @@ -1393,6 +1400,10 @@ spec:
rule: '!has(oldSelf.ingressIPs) || has(self.ingressIPs)'
type: object
x-kubernetes-validations:
- message: vcenters can have at most 1 item when configured
post-install
rule: '!has(oldSelf.vsphere) && has(self.vsphere) ? (has(self.vsphere.vcenters)
&& size(self.vsphere.vcenters) < 2) : true'
- message: vcenters is required once set and cannot be removed
rule: 'oldSelf.?vsphere.vcenters.hasValue() ? self.?vsphere.vcenters.hasValue()
: true'
Expand Down
3 changes: 3 additions & 0 deletions ..._generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,9 @@ spec:
<key-id-or-alias> is the KMS key ID or alias name.
type: string
x-kubernetes-validations:
- message: 'kmsKeyARN must be a valid AWS KMS key ARN in the
format: arn:<partition>:kms:<region>:<account-id>:(key|alias)/<key-id-or-alias>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$')
- message: 'kmsKeyARN must be a valid AWS KMS key ARN in the
format: arn:<partition>:kms:<region>:<account-id>:(key|alias)/<key-id-or-alias>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$')
Expand Down
3 changes: 3 additions & 0 deletions ...erated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,9 @@ spec:
<key-id-or-alias> is the KMS key ID or alias name.
type: string
x-kubernetes-validations:
- message: 'kmsKeyARN must be a valid AWS KMS key ARN in the
format: arn:<partition>:kms:<region>:<account-id>:(key|alias)/<key-id-or-alias>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$')
- message: 'kmsKeyARN must be a valid AWS KMS key ARN in the
format: arn:<partition>:kms:<region>:<account-id>:(key|alias)/<key-id-or-alias>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$')
Expand Down
3 changes: 3 additions & 0 deletions ...rated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,9 @@ spec:
<key-id-or-alias> is the KMS key ID or alias name.
type: string
x-kubernetes-validations:
- message: 'kmsKeyARN must be a valid AWS KMS key ARN in the
format: arn:<partition>:kms:<region>:<account-id>:(key|alias)/<key-id-or-alias>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$')
- message: 'kmsKeyARN must be a valid AWS KMS key ARN in the
format: arn:<partition>:kms:<region>:<account-id>:(key|alias)/<key-id-or-alias>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f|aws-eusc):kms:[a-z0-9-]+:[0-9]{12}:(key|alias)/.*$')
Expand Down
3 changes: 3 additions & 0 deletions payload-manifests/crds/0000_10_config-operator_01_dnses-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,9 @@ spec:
<role-name> is the IAM role name.
type: string
x-kubernetes-validations:
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
Expand Down
3 changes: 3 additions & 0 deletions payload-manifests/crds/0000_10_config-operator_01_dnses-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,9 @@ spec:
<role-name> is the IAM role name.
type: string
x-kubernetes-validations:
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
Expand Down
3 changes: 3 additions & 0 deletions payload-manifests/crds/0000_10_config-operator_01_dnses-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,9 @@ spec:
<role-name> is the IAM role name.
type: string
x-kubernetes-validations:
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.*$')
- message: 'privateZoneIAMRole must be a valid AWS IAM role
ARN in the format: arn:<partition>:iam::<account-id>:role/<role-name>'
rule: matches(self, '^arn:(aws|aws-cn|aws-us-gov|aws-eusc):iam::[0-9]{12}:role/.*$')
Expand Down
Loading