NO-JIRA: fix(api): replace CEL url() validators with regex to fix CRD cost budget by enxebre · Pull Request #8004 · openshift/hypershift

enxebre · 2026-03-18T23:03:09Z

Summary

The isURL()/url() CEL functions introduced in CNTRLPLANE-2677: Add HCPEtcdBackup CRD API and feature gate #7898 for encryptionKeyURL and snapshotURL fields are extremely expensive in the API server's cost estimator. This causes the HostedCluster CRD to exceed the x-kubernetes-validations cost budget by >100x, breaking TechPreview HyperShift installs.
Replace isURL()/url() CEL rules with equivalent self.matches() regex validation which has a much lower cost.
Reduce encryptionKeyURL maxLength from 512 to 210 to further lower the estimated cost. Azure Key Vault URLs are well under 210 characters.

The size is reduced to 210 which based on https://learn.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates should give 4 chars headroom.

This was caught by the e2e-aws-autonode CI job failing during the hypershift-install step:
See failing test https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_hypershift/7939/pull-ci-openshift-hypershift-main-e2e-aws-autonode/2034351694233473024

spec.validation.openAPIV3Schema.properties[spec].properties[etcd].properties[managed].properties[backup].properties[azure].properties[encryptionKeyURL].x-kubernetes-validations[2].rule: Forbidden: estimated rule cost exceeds budget by factor of more than 100x

We'll add envtest-based testing to catch techpreview CRD cost budget violations before merge going forward.

Test plan

make update && make verify passes
make build succeeds
CRD applies successfully to a live cluster without cost budget errors

🤖 Generated with Claude Code

The isURL()/url() CEL functions used in HCPEtcdBackup encryptionKeyURL and snapshotURL validators are extremely expensive in the API server's cost estimator. This caused the HostedCluster CRD to exceed the x-kubernetes-validations cost budget by >100x, breaking TechPreview installs. Replace isURL()/url() CEL rules with equivalent self.matches() regex validation and reduce encryptionKeyURL maxLength from 512 to 210 to further lower the estimated cost. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-ci-robot · 2026-03-18T23:03:13Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-03-18T23:03:28Z

📝 Walkthrough

Walkthrough

The pull request refactors URL validation rules in the etcdbackup API types. Multiple EncryptionKeyURL fields across HCPEtcdBackupAzureBlob, HCPEtcdBackupEncryptionMetadataAzure, and HCPEtcdBackupConfigAzure are consolidated to use a single Azure Key Vault HTTPS URL pattern validation, with their maximum length reduced from 512 to 210 characters. Additionally, the SnapshotURL field validation in HCPEtcdBackupStatus is updated to use a unified regex pattern that enforces https or s3 URI schemes, replacing separate scheme and URL validation checks. No public API signatures are modified.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-ci · 2026-03-18T23:03:34Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-03-18T23:03:36Z

@enxebre: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

The isURL()/url() CEL functions introduced in CNTRLPLANE-2677: Add HCPEtcdBackup CRD API and feature gate #7898 for encryptionKeyURL and snapshotURL fields are extremely expensive in the API server's cost estimator. This causes the HostedCluster CRD to exceed the x-kubernetes-validations cost budget by >100x, breaking TechPreview and CustomNoUpgrade HyperShift installs.

Replace isURL()/url() CEL rules with equivalent self.matches() regex validation which has a much lower cost.

Reduce encryptionKeyURL maxLength from 512 to 210 to further lower the estimated cost. Azure Key Vault URLs are well under 210 characters.

This was caught by the e2e-aws-autonode CI job failing during the hypershift-install step:
spec.validation.openAPIV3Schema.properties[spec].properties[etcd].properties[managed].properties[backup].properties[azure].properties[encryptionKeyURL].x-kubernetes-validations[2].rule: Forbidden: estimated rule cost exceeds budget by factor of more than 100x
We'll add envtest-based testing to catch CRD cost budget violations before merge going forward.

Test plan

make update && make verify passes

make build succeeds

CRD applies successfully to a live cluster without cost budget errors

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

enxebre · 2026-03-18T23:06:11Z

/test verify

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@api/hypershift/v1beta1/etcdbackup_types.go`:
- Around line 186-189: The kubebuilder validation for EncryptionKeyURL uses
MaxLength=210 which is too small for worst-case Azure Key Vault URLs; update the
kubebuilder tag on the EncryptionKeyURL field (the struct field EncryptionKeyURL
in etcdbackup_types.go) to a larger value (e.g., 220) to safely accommodate the
documented maximum component lengths, leaving the XValidation regex/immutability
rules unchanged.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 72bc48ba-df12-4a5f-a572-2b9bd2a6555b

📥 Commits

Reviewing files that changed from the base of the PR and between 64e96a9 and 44a1ecc.

⛔ Files ignored due to path filters (10)

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/**, !cmd/install/assets/**/*.yaml
vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.go is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (1)

api/hypershift/v1beta1/etcdbackup_types.go

coderabbitai · 2026-03-18T23:10:55Z

+	// +kubebuilder:validation:MaxLength=210
+	// +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://<vault>.vault.azure.net/keys/<key-name>[/<key-version>])"
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="encryptionKeyURL is immutable"
 	EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"`


⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify Azure Key Vault naming constraints echo "Checking Azure Key Vault documentation references in codebase..." rg -n "vault.azure.net" --type go -C2 echo "" echo "Finding any existing MaxLength constraints for Azure URLs..." rg -n "MaxLength.*[0-9]+" api/ --type go | grep -i azure

Repository: openshift/hypershift

Length of output: 16951

MaxLength=210 is insufficient for maximum-length Azure Key Vault URLs.

The documented format https://<vault-name>.vault.azure.net/keys/<key-name>[/<key-version>] with maximum allowed component lengths requires 213 characters:

https:// (8) + vault-name (24 max) + .vault.azure.net/keys/ (21) + key-name (127 max) + / + version (32 max) = 213

While practical real-world URLs are significantly shorter, consider increasing to 215–220 to fully accommodate the documented format specification.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@api/hypershift/v1beta1/etcdbackup_types.go` around lines 186 - 189, The kubebuilder validation for EncryptionKeyURL uses MaxLength=210 which is too small for worst-case Azure Key Vault URLs; update the kubebuilder tag on the EncryptionKeyURL field (the struct field EncryptionKeyURL in etcdbackup_types.go) to a larger value (e.g., 220) to safely accommodate the documented maximum component lengths, leaving the XValidation regex/immutability rules unchanged.

maxcao13 · 2026-03-19T00:38:40Z

/test e2e-aws-techpreview
/test e2e-aws-autonode

openshift-ci · 2026-03-19T03:41:04Z

@enxebre: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-techpreview	`44a1ecc`	link	false	`/test e2e-aws-techpreview`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

enxebre · 2026-03-19T07:34:29Z

spot test failed for unrelated reason https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_hypershift/8004/pull-ci-openshift-hypershift-main-e2e-aws-techpreview/2034429330443997184

/e2e-aws-autonode
pased. Merging this to unblock e2e-techpreview job.

openshift-ci Bot added the do-not-merge/needs-area label Mar 18, 2026

openshift-ci Bot requested a review from devguyio March 18, 2026 23:03

enxebre changed the title ~~fix(api): replace CEL url() validators with regex to fix CRD cost budget~~ NO-JIRA: fix(api): replace CEL url() validators with regex to fix CRD cost budget Mar 18, 2026

openshift-ci Bot requested a review from jparrill March 18, 2026 23:03

openshift-ci Bot added the area/api Indicates the PR includes changes for the API label Mar 18, 2026

openshift-ci Bot added area/cli Indicates the PR includes changes for CLI approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Mar 18, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 18, 2026

openshift-ci Bot removed the do-not-merge/needs-area label Mar 18, 2026

coderabbitai Bot reviewed Mar 18, 2026

View reviewed changes

enxebre merged commit 86ecee6 into openshift:main Mar 19, 2026
16 of 23 checks passed

maxcao13 mentioned this pull request Mar 19, 2026

AUTOSCALE-570: Expose MetadataOptions on OpenShiftEC2NodeClass #7958

Merged

4 tasks

hypershift-jira-solve-ci Bot mentioned this pull request Apr 30, 2026

CNTRLPLANE-647: Expose v4/v6InternalSubnet OVN-Kubernetes configuration in HostedCluster API #8249

Merged

4 tasks

rutvik23 mentioned this pull request May 5, 2026

OCPBUGS-77827: fix(api): add missing has() guards to servingCerts CEL validation rule #8331

Merged

4 tasks

Navigation Menu

Uh oh!

NO-JIRA: fix(api): replace CEL url() validators with regex to fix CRD cost budget - #8004

NO-JIRA: fix(api): replace CEL url() validators with regex to fix CRD cost budget#8004
enxebre merged 1 commit into
openshift:mainfrom
enxebre:fix-cel-cost-budget-etcdbackup

enxebre commented Mar 18, 2026 •

edited

Loading

Uh oh!

openshift-ci-robot commented Mar 18, 2026

Uh oh!

coderabbitai Bot commented Mar 18, 2026 •

edited

Loading

Walkthrough

Uh oh!

openshift-ci Bot commented Mar 18, 2026

Uh oh!

openshift-ci-robot commented Mar 18, 2026

Summary

Test plan

Uh oh!

enxebre commented Mar 18, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Mar 18, 2026

Uh oh!

maxcao13 commented Mar 19, 2026

Uh oh!

openshift-ci Bot commented Mar 19, 2026

Uh oh!

enxebre commented Mar 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

enxebre commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

openshift-ci-robot commented Mar 18, 2026

Uh oh!

coderabbitai Bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

openshift-ci Bot commented Mar 18, 2026

Uh oh!

openshift-ci-robot commented Mar 18, 2026

Summary

Test plan

Uh oh!

enxebre commented Mar 18, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

maxcao13 commented Mar 19, 2026

Uh oh!

openshift-ci Bot commented Mar 19, 2026

Uh oh!

enxebre commented Mar 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

enxebre commented Mar 18, 2026 •

edited

Loading

coderabbitai Bot commented Mar 18, 2026 •

edited

Loading