Use regex instead of format help for KMS secret name validation

[JoelSpeed]

The current validation using the format library is breaking HyperShift integration testing, this will be functionally equivalent but not rely on the library which came later

CC @ardaguclu

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hello @JoelSpeed! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[qodo-for-rh-openshift]

PR Summary by Qodo

Replace CEL format-based DNS1123 validation with regex for KMS/Vault refs

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Replace CEL format.dns1123Subdomain() validation with portable regex matching.
• Fix HyperShift integration failures caused by unavailable CEL format library.
• Regenerate CRD manifests so published schemas match the new validation rule.

Diagram

graph TD
  A["KMSEncryption API types"] --> B["Kubebuilder XValidation"] --> C["Generated CRDs (config)"] --> D["Payload CRDs"] --> E["API server CEL"] --> F["Resource admission"]
  subgraph Legend
    direction LR
    _code["Source code"] ~~~ _cfg["Manifest"] ~~~ _svc(["Runtime validation"])
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Require CEL format library availability

• ➕ Keeps intent aligned with higher-level DNS1123 helper
• ➕ Avoids maintaining a custom regex
• ➖ Breaks older API servers/HyperShift environments lacking the format library
• ➖ Couples validation to specific CEL feature availability

2. Use OpenAPI `pattern` instead of XValidation

• ➕ Shifts validation to widely supported OpenAPI schema keywords
• ➕ Avoids CEL feature/version dependencies
• ➖ May not express identical constraints depending on tooling/CRD generation path
• ➖ Requires reworking existing XValidation usage and regeneration expectations

Recommendation: Keep the regex-based self.matches(...) XValidation. It avoids dependency on newer CEL format helpers (the reported breakage) while preserving equivalent DNS1123 subdomain constraints, and it cleanly propagates through regenerated CRDs.

Files changed (8) +24 / -24

Bug fix (1) +3 / -3

types_kmsencryption.goSwap DNS1123 CEL format validation to regex for Vault reference fields +3/-3

Swap DNS1123 CEL format validation to regex for Vault reference fields

• Replaces 'format.dns1123Subdomain().validate(self)' XValidation rules with a portable 'self.matches(...)' regex for Vault secret name, configmap name, and TLS serverName fields. This preserves the DNS1123-like constraint without relying on the CEL format library.

config/v1/types_kmsencryption.go

Other (7) +21 / -21

0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yamlRegenerate CustomNoUpgrade apiservers CRD with regex-based CEL rules +3/-3

Regenerate CustomNoUpgrade apiservers CRD with regex-based CEL rules

• Updates the CRD schema rule strings to use 'self.matches(...)' instead of 'format.dns1123Subdomain()' for affected fields, matching the updated kubebuilder markers.

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml

0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yamlRegenerate DevPreviewNoUpgrade apiservers CRD with regex-based CEL rules +3/-3

Regenerate DevPreviewNoUpgrade apiservers CRD with regex-based CEL rules

• Updates the generated CEL rule expressions to regex matching to avoid the CEL format helper dependency.

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml

0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yamlRegenerate TechPreviewNoUpgrade apiservers CRD with regex-based CEL rules +3/-3

Regenerate TechPreviewNoUpgrade apiservers CRD with regex-based CEL rules

• Replaces format-based DNS1123 validation rules with regex-based 'self.matches(...)' in the generated schema.

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml

KMSEncryption.yamlUpdate featuregated KMSEncryption CRD to use regex-based CEL validation +3/-3

Update featuregated KMSEncryption CRD to use regex-based CEL validation

• Aligns the featuregated KMSEncryption CRD manifest with the new regex-based XValidation rules to ensure consistent validation across feature gates.

config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml

0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yamlUpdate payload CustomNoUpgrade CRD with regex-based CEL rules +3/-3

Update payload CustomNoUpgrade CRD with regex-based CEL rules

• Propagates the regex-based CEL validation rules into the payload CRD so clusters enforce the portable rule at runtime.

payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml

0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yamlUpdate payload DevPreviewNoUpgrade CRD with regex-based CEL rules +3/-3

Update payload DevPreviewNoUpgrade CRD with regex-based CEL rules

• Updates the payload CRD schema rule strings to the regex-based form for compatibility with environments lacking the format library.

payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml

0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yamlUpdate payload TechPreviewNoUpgrade CRD with regex-based CEL rules +3/-3

Update payload TechPreviewNoUpgrade CRD with regex-based CEL rules

• Ensures the TechPreview payload CRD uses 'self.matches(...)' for DNS1123-like validation consistent with the API types.

payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a2b7e06c-d73e-49da-adcc-70ffa4555437

📥 Commits

Reviewing files that changed from the base of the PR and between 72624b9 and e5a6b6c.

⛔ Files ignored due to path filters (4)

• config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
• config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
• config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
• config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**

📒 Files selected for processing (4)

• config/v1/types_kmsencryption.go
• payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml
• payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml
• payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml

---

📝 Walkthrough

Walkthrough

This change replaces CEL validation expressions that call format.dns1123Subdomain().validate(self) with explicit regular-expression checks. The affected fields are the Vault AppRole secret name, the Vault TLS CA ConfigMap name, and the Vault TLS serverName. The change appears in config/v1/types_kmsencryption.go and propagates to three generated CRD manifest files (CustomNoUpgrade, DevPreviewNoUpgrade, and TechPreviewNoUpgrade). Each file has three single-line validation rule updates. No exported or public entity declarations change.

Suggested reviewers: ardaguclu, flavianmissi, davidesalerno

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title refers to validation changes but does not accurately describe the changeset, which replaces format-based DNS validation across multiple CRD files, not only KMS secret names.	Update the title to reflect the scope: replace 'KMS secret name validation' with a broader term like 'DNS validation' or 'format-based validation' since changes affect AppRole secrets, ConfigMap names, and TLS server names.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description explains the motivation and functional goal of the change, which relates to the changeset even though it mentions KMS secret names specifically.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only KMS validation source and generated CRD manifests; no Ginkgo test declarations or test titles are present in the changed files.
Test Structure And Quality	✅ Passed	The commit changes only validation annotations and generated CRDs; it adds or modifies no Ginkgo tests, It blocks, setup, cleanup, waits, or assertions.
Microshift Test Compatibility	✅ Passed	The pull request changes only KMS type and CRD YAML files; it adds no Ginkgo tests or other test code requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only validation comments and generated CRD manifests; it adds no Ginkgo e2e tests or test logic requiring multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	PR contains only CEL validation rule changes for DNS names in KMS encryption config schemas. No scheduling constraints, deployment manifests, pod affinity, topology assumptions, or scheduling infra...
Ote Binary Stdout Contract	✅ Passed	Pull request modifies only API type definitions and YAML manifests with no process-level executable code that writes to stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR contains no new Ginkgo e2e tests. Changes are validation rules in type definitions and CRD manifests, not test code.
No-Weak-Crypto	✅ Passed	The patch adds only CEL DNS regex validations; no weak-crypto markers or crypto APIs appear in added lines, and existing DES-CBC3-SHA entries are unchanged.
Container-Privileges	✅ Passed	The patch changes only CEL DNS validation rules in Go and CRD files; no privileged, host namespace, SYS_ADMIN, root, or allowPrivilegeEscalation settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	The PR replaces CEL validation expressions without adding logging code. Error messages describe validation constraints only and do not expose sensitive data like passwords, tokens, API keys, or PII.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-rh-openshift]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[ardaguclu]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

[ardaguclu]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ardaguclu
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@JoelSpeed: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-hypershift-integration	e5a6b6c	link	true	/test verify-hypershift-integration
ci/prow/e2e-aws-ovn-hypershift-conformance	e5a6b6c	link	true	/test e2e-aws-ovn-hypershift-conformance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.