- enum: check every rule's option so an undefined option always errors, matching IfOption
- operation.Options: note an option can be enabled even when its feature gate is off
- api/testing: fall back to strategy options only when the caller supplied none
HPA, workload, and PodGroup strategies declare their options as map[string]bool,
and the versioned validation-equivalence sweep is given each strategy's declared
options so referenced options are not treated as undeclared.
Add FilterCoveredHandwrittenErrors and FilterEnforcedDeclarativeErrors helpers to pkg/api/validate in a dedicated errors.go file for reuse across declarative validation pathways.
TestVersionedValidationByFuzzing swept a hand-maintained list of
group/versions that had a typo (network.k8s.io) and omitted several
groups (apps, policy, rbac, flowcontrol, scheduling). Replace it with a
sweep of the scheme for served GVKs that have declarative validation,
so new group/versions are covered automatically.
Skip extensions/v1beta1 centrally in VerifyVersionedValidationEquivalence
instead of via the per-call WithSkipGroupVersions option: it opts out of
declarative validation but shares an internal type with versions that do
not. Any other version missing declarative validation now fails the sweep
rather than being silently skipped.
The gate is GA and locked to true, so explicitly setting it in the
equivalence test harness only emits a 'setting GA feature gate' warning
without changing behavior. Rely on its locked default instead.
Add WithSkipGroupVersions and apply it to the NetworkPolicy and Scale tests,
whose internal types also register under the now-unvalidated extensions/v1beta1.
With DV always enforced, the "hand written validation" subtest (which
set DeclarativeValidation=off and emulated 1.35) now exercises the
same code path as "Beta disabled". Remove it along with the
MinEmulationVersion option, the WithMinEmulationVersion helper,
deDuplicateErrors, and the now-tautological imperative-vs-declarative
equivalence checks.
Variant of VerifyUpdateValidationEquivalence that accepts a validate
closure instead of a RESTUpdateStrategy, for callers that produce
handwritten and declarative validation errors directly.
VerifyValidationEquivalence's all-rules-enforced subtest now extracts
the GVK from the request context and forwards each error to
coverage.RecordObservedRules so AssertDeclarativeCoverage (in the
generated TestMain) can confirm every declared rule fired.
When a test enables a feature gate introduced after 1.35, the "hand
written validation" sub-test fails because SetFeatureGateEmulationVersionDuringTest
cannot downgrade to 1.35 for features that did not exist at that version.
This adds a WithMinEmulationVersion option so callers can declare the
minimum supported emulation version and skip the sub-test when incompatible.
- Test scenarios: Beta Enabled, Beta Disabled, and Legacy (emulated 1.35).
- Remove deprecated Takeover gate references and redundant coverage checks.
- Add TODO to remove legacy emulation in 1.39.
- Update documentation to match the new Validation Lifecycle strategy.
Fuzzing must be performed on the internal version of objects because
custom fuzzing functions are typically registered for internal types.
This ensures that all fields are properly initialized with random values
before being converted to various API versions for validation.
Move fuzzing logic into VerifyVersionedValidationEquivalence via a new
WithFuzzer option. This also fixes a panic that occurred when attempting
to fuzz types without an internal version (e.g., APIGroupList) by adding
a nil check after internal conversion.
This change graduates the 'DeclarativeValidation' feature gate to GA in v1.36.
The feature gate is now locked to 'true' by default.
Changes:
- Updated 'DeclarativeValidation' feature gate to GA in 'pkg/features/kube_features.go' and 'staging/src/k8s.io/apiserver/pkg/features/kube_features.go'.
- Updated feature gate documentation and versioned lists via 'hack/update-featuregates.sh'.
- Added feature gate emulation versioning to tests that explicitly disable 'DeclarativeValidation' to prevent panics now that the gate is locked to default.
This commit adds an 'IgnoreObjectConversionErrors' option to the
validation testing framework in 'k8s.io/apimachinery' and exposes it
via 'pkg/api/testing'.
This is useful for fuzzing tests where we might want to skip object
versions that cannot be converted from the internal version (e.g. due to
missing fields or incompatible types in older versions) but still want
to test validation for the versions that *can* be converted.
The 'autoscaling' group versions are added to 'TestVersionedValidationByFuzzing'
with this option enabled.
Introduces new testing helpers to simplify testing of declarative validation rules. The new `VerifyValidationEquivalence` and `VerifyUpdateValidationEquivalence` functions reduce boilerplate by encapsulating the logic for:
- Toggling the `DeclarativeValidation` and `DeclarativeValidationTakeover` feature gates.
- Comparing the validation output from the imperative and declarative paths.
The declarative validation tests for CertificateSigningRequest and ReplicationController are updated to use these new, simpler helpers.
This makes a bold assumption: that the errors (count and basic content)
will be the same across versions. If this turns out to be untrue, this
may need to get more sophisticated. It should fail obviously when we
hit that edge.
