Skip to content

feat(validation): add pre-execution validation layer#764

Merged
manusa merged 3 commits intocontainers:mainfrom
nader-ziada:validation
Feb 23, 2026
Merged

feat(validation): add pre-execution validation layer#764
manusa merged 3 commits intocontainers:mainfrom
nader-ziada:validation

Conversation

@nader-ziada
Copy link
Copy Markdown
Collaborator

@nader-ziada nader-ziada commented Feb 10, 2026

Add validation middleware that catches errors before they reach the Kubernetes API.

Changes:

  • Resource validation: catches typos in resource types (GVK)
  • Schema validation: validates manifests against OpenAPI schema
  • RBAC validation: pre-checks permissions using SelfSubjectAccessReview
  • All validators are enabled by default and can be configured via environment variables (MCP_VALIDATION_*) or TOML config.

Closes #775

Comment thread pkg/validation/middleware.go Outdated
Comment thread pkg/validation/rbac_validator.go Outdated
Comment thread pkg/validation/middleware.go Outdated
Copy link
Copy Markdown
Member

@manusa manusa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thx for putting this together.
I gave it an initial look and added a few comments.

Comment thread pkg/mcp/mcp.go Outdated
Comment thread pkg/mcp/mcp.go Outdated
@nader-ziada
Copy link
Copy Markdown
Collaborator Author

made a refactor of how this works, sorry to the reviewers, to make work from the kubernetes pkg instead of the mcp pkg, now more dynamic and flexible. also disabled by default.

@manusa manusa self-requested a review February 16, 2026 13:34
Copy link
Copy Markdown
Member

@manusa manusa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that the decoupling from the mcp layer is going great, thx.
I added some more comments regarding the new approach.

Comment thread pkg/config/validation_config.go Outdated
Comment thread pkg/config/validation_config.go Outdated
Comment thread pkg/kubernetes/validation_round_tripper.go Outdated
Comment thread pkg/mcp/events_test.go Outdated
Comment thread pkg/mcp/pods_test.go Outdated
Comment thread README.md
@nader-ziada nader-ziada requested a review from manusa February 18, 2026 13:44
Copy link
Copy Markdown
Member

@manusa manusa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the late review, I wanted to check the changes locally to ensure the tests in pkg/mcp could be reverted to their original state in main (they can).

I added a few more comments for your consideration.

Comment thread pkg/mcp/events_test.go
Comment thread pkg/mcp/namespaces_test.go
Comment thread pkg/mcp/pods_test.go
Comment thread pkg/mcp/resources_test.go
Comment thread pkg/api/config.go
restMapper := rt.restMapperProvider()
if restMapper == nil {
return nil, fmt.Errorf("failed to make request: AccessControlRoundTripper restMapper not initialized")
return nil, fmt.Errorf("failed to make request: restMapper not initialized")
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is AccessControlRoundTripper (again), this change shouldn't be necessary, the original error provides better context for debugging.

Comment thread pkg/api/validation.go Outdated
Comment thread pkg/api/validation.go Outdated
Comment thread pkg/api/validation.go Outdated
Comment thread pkg/api/validation.go Outdated
@nader-ziada
Copy link
Copy Markdown
Collaborator Author

@manusa thanks for the review, I addressed the comments and mostly applied your suggestions to simplify the code.

@nader-ziada nader-ziada force-pushed the validation branch 3 times, most recently from 30eff21 to 83fbd1f Compare February 19, 2026 16:26
Add validation middleware that catches errors before they reach the
Kubernetes API.

Signed-off-by: Nader Ziada <nziada@redhat.com>
Signed-off-by: Nader Ziada <nziada@redhat.com>
cleanup up unused func and fields

Signed-off-by: Nader Ziada <nziada@redhat.com>
Copy link
Copy Markdown
Member

@manusa manusa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thx!

@manusa manusa added this to the 0.1.0 milestone Feb 23, 2026
@manusa manusa merged commit 9a33b10 into containers:main Feb 23, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants