From 44a1ecc7e51fdc776c79b9fb53b1813e491dae02 Mon Sep 17 00:00:00 2001 From: enxebre Date: Thu, 19 Mar 2026 00:02:47 +0100 Subject: [PATCH] fix(api): replace CEL url() validators with regex to fix CRD cost budget The isURL()/url() CEL functions used in HCPEtcdBackup encryptionKeyURL and snapshotURL validators are extremely expensive in the API server's cost estimator. This caused the HostedCluster CRD to exceed the x-kubernetes-validations cost budget by >100x, breaking TechPreview installs. Replace isURL()/url() CEL rules with equivalent self.matches() regex validation and reduce encryptionKeyURL maxLength from 512 to 210 to further lower the estimated cost. Co-Authored-By: Claude Opus 4.6 (1M context) --- api/hypershift/v1beta1/etcdbackup_types.go | 21 ++++-------- .../HCPEtcdBackup.yaml | 33 ++++++------------- .../HCPEtcdBackup.yaml | 14 +++----- .../HCPEtcdBackup.yaml | 14 +++----- .../hcpetcdbackups-CustomNoUpgrade.crd.yaml | 33 ++++++------------- ...petcdbackups-TechPreviewNoUpgrade.crd.yaml | 33 ++++++------------- ...usters-Hypershift-CustomNoUpgrade.crd.yaml | 14 +++----- ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 14 +++----- ...planes-Hypershift-CustomNoUpgrade.crd.yaml | 14 +++----- ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 14 +++----- .../hypershift/v1beta1/etcdbackup_types.go | 21 ++++-------- 11 files changed, 68 insertions(+), 157 deletions(-) diff --git a/api/hypershift/v1beta1/etcdbackup_types.go b/api/hypershift/v1beta1/etcdbackup_types.go index 915400537359..d667e2619515 100644 --- a/api/hypershift/v1beta1/etcdbackup_types.go +++ b/api/hypershift/v1beta1/etcdbackup_types.go @@ -183,10 +183,8 @@ type HCPEtcdBackupAzureBlob struct { // This field is immutable once set and cannot be removed. // +optional // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=512 - // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() == 'https'",message="encryptionKeyURL must be a valid HTTPS URL" - // +kubebuilder:validation:XValidation:rule="url(self).getHostname().matches('[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net$')",message="encryptionKeyURL must point to an Azure Key Vault (*.vault.azure.net)" - // +kubebuilder:validation:XValidation:rule="url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL path must be /keys/ or /keys//" + // +kubebuilder:validation:MaxLength=210 + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="encryptionKeyURL is immutable" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } @@ -209,8 +207,7 @@ type HCPEtcdBackupStatus struct { // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=2048 - // +kubebuilder:validation:XValidation:rule="isURL(self)",message="snapshotURL must be a valid URL" - // +kubebuilder:validation:XValidation:rule="url(self).getScheme() == 'https' || url(self).getScheme() == 's3'",message="snapshotURL scheme must be https or s3" + // +kubebuilder:validation:XValidation:rule="self.matches('^(https|s3)://.*')",message="snapshotURL must be a valid URL with scheme https or s3" SnapshotURL string `json:"snapshotURL,omitempty"` // encryptionMetadata contains metadata about the encryption of the backup. @@ -256,10 +253,8 @@ type HCPEtcdBackupEncryptionMetadataAzure struct { // "https://.vault.azure.net/keys/[/]". // +required // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=512 - // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() == 'https'",message="encryptionKeyURL must be a valid HTTPS URL" - // +kubebuilder:validation:XValidation:rule="url(self).getHostname().matches('[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net$')",message="encryptionKeyURL must point to an Azure Key Vault (*.vault.azure.net)" - // +kubebuilder:validation:XValidation:rule="url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL path must be /keys/ or /keys//" + // +kubebuilder:validation:MaxLength=210 + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } @@ -358,9 +353,7 @@ type HCPEtcdBackupConfigAzure struct { // "https://.vault.azure.net/keys/[/]". // +required // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=512 - // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() == 'https'",message="encryptionKeyURL must be a valid HTTPS URL" - // +kubebuilder:validation:XValidation:rule="url(self).getHostname().matches('[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net$')",message="encryptionKeyURL must point to an Azure Key Vault (*.vault.azure.net)" - // +kubebuilder:validation:XValidation:rule="url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL path must be /keys/ or /keys//" + // +kubebuilder:validation:MaxLength=210 + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yaml index 4b04cd79d9be..6017107c92b8 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hcpetcdbackups.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -105,18 +105,13 @@ spec: Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". This field is immutable once set and cannot be removed. - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure Key Vault - (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure Key Vault + HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') - message: encryptionKeyURL is immutable rule: self == oldSelf keyPrefix: @@ -380,18 +375,13 @@ spec: encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure Key Vault - (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure Key Vault + HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object @@ -404,11 +394,8 @@ spec: minLength: 1 type: string x-kubernetes-validations: - - message: snapshotURL must be a valid URL - rule: isURL(self) - - message: snapshotURL scheme must be https or s3 - rule: url(self).getScheme() == 'https' || url(self).getScheme() - == 's3' + - message: snapshotURL must be a valid URL with scheme https or s3 + rule: self.matches('^(https|s3)://.*') type: object required: - spec diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml index 281868c713f7..def9e7a37dca 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -2338,19 +2338,13 @@ spec: encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS - URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure - Key Vault (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure + Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml index 1e6e2f4d09e2..0ff98276128b 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/HCPEtcdBackup.yaml @@ -2269,19 +2269,13 @@ spec: encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS - URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure - Key Vault (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure + Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object diff --git a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml index daa5c0eb080c..18455961b46f 100644 --- a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-CustomNoUpgrade.crd.yaml @@ -108,18 +108,13 @@ spec: Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". This field is immutable once set and cannot be removed. - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure Key Vault - (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure Key Vault + HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') - message: encryptionKeyURL is immutable rule: self == oldSelf keyPrefix: @@ -383,18 +378,13 @@ spec: encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure Key Vault - (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure Key Vault + HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object @@ -407,11 +397,8 @@ spec: minLength: 1 type: string x-kubernetes-validations: - - message: snapshotURL must be a valid URL - rule: isURL(self) - - message: snapshotURL scheme must be https or s3 - rule: url(self).getScheme() == 'https' || url(self).getScheme() - == 's3' + - message: snapshotURL must be a valid URL with scheme https or s3 + rule: self.matches('^(https|s3)://.*') type: object required: - spec diff --git a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml index 813e7c23287e..845e0c89f54d 100644 --- a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hcpetcdbackups-TechPreviewNoUpgrade.crd.yaml @@ -108,18 +108,13 @@ spec: Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". This field is immutable once set and cannot be removed. - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure Key Vault - (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure Key Vault + HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') - message: encryptionKeyURL is immutable rule: self == oldSelf keyPrefix: @@ -383,18 +378,13 @@ spec: encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup. Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure Key Vault - (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure Key Vault + HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object @@ -407,11 +397,8 @@ spec: minLength: 1 type: string x-kubernetes-validations: - - message: snapshotURL must be a valid URL - rule: isURL(self) - - message: snapshotURL scheme must be https or s3 - rule: url(self).getScheme() == 'https' || url(self).getScheme() - == 's3' + - message: snapshotURL must be a valid URL with scheme https or s3 + rule: self.matches('^(https|s3)://.*') type: object required: - spec diff --git a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml index 4263f2928f94..168d5d89c9e2 100644 --- a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml @@ -3366,19 +3366,13 @@ spec: encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS - URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure - Key Vault (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure + Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object diff --git a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml index 19a2d380c9f5..20c8deab7760 100644 --- a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -3177,19 +3177,13 @@ spec: encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS - URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure - Key Vault (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure + Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object diff --git a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml index 780b8a336e11..d02bc29c4d71 100644 --- a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml @@ -3299,19 +3299,13 @@ spec: encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS - URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure - Key Vault (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure + Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object diff --git a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml index d67e6ea5123a..d219694da11b 100644 --- a/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml +++ b/cmd/install/assets/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-TechPreviewNoUpgrade.crd.yaml @@ -3110,19 +3110,13 @@ spec: encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts. Must be a valid Azure Key Vault key URL in the format "https://.vault.azure.net/keys/[/]". - maxLength: 512 + maxLength: 210 minLength: 1 type: string x-kubernetes-validations: - - message: encryptionKeyURL must be a valid HTTPS - URL - rule: isURL(self) && url(self).getScheme() == 'https' - - message: encryptionKeyURL must point to an Azure - Key Vault (*.vault.azure.net) - rule: url(self).getHostname().matches('[a-zA-Z0-9-]+\\.vault\\.azure\\.net$') - - message: encryptionKeyURL path must be /keys/ - or /keys// - rule: url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') + - message: encryptionKeyURL must be a valid Azure + Key Vault HTTPS URL (https://.vault.azure.net/keys/[/]) + rule: self.matches('^https://[a-zA-Z0-9-]+\\.vault\\.azure\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$') required: - encryptionKeyURL type: object diff --git a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.go b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.go index 915400537359..d667e2619515 100644 --- a/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.go +++ b/vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/etcdbackup_types.go @@ -183,10 +183,8 @@ type HCPEtcdBackupAzureBlob struct { // This field is immutable once set and cannot be removed. // +optional // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=512 - // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() == 'https'",message="encryptionKeyURL must be a valid HTTPS URL" - // +kubebuilder:validation:XValidation:rule="url(self).getHostname().matches('[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net$')",message="encryptionKeyURL must point to an Azure Key Vault (*.vault.azure.net)" - // +kubebuilder:validation:XValidation:rule="url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL path must be /keys/ or /keys//" + // +kubebuilder:validation:MaxLength=210 + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="encryptionKeyURL is immutable" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } @@ -209,8 +207,7 @@ type HCPEtcdBackupStatus struct { // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=2048 - // +kubebuilder:validation:XValidation:rule="isURL(self)",message="snapshotURL must be a valid URL" - // +kubebuilder:validation:XValidation:rule="url(self).getScheme() == 'https' || url(self).getScheme() == 's3'",message="snapshotURL scheme must be https or s3" + // +kubebuilder:validation:XValidation:rule="self.matches('^(https|s3)://.*')",message="snapshotURL must be a valid URL with scheme https or s3" SnapshotURL string `json:"snapshotURL,omitempty"` // encryptionMetadata contains metadata about the encryption of the backup. @@ -256,10 +253,8 @@ type HCPEtcdBackupEncryptionMetadataAzure struct { // "https://.vault.azure.net/keys/[/]". // +required // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=512 - // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() == 'https'",message="encryptionKeyURL must be a valid HTTPS URL" - // +kubebuilder:validation:XValidation:rule="url(self).getHostname().matches('[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net$')",message="encryptionKeyURL must point to an Azure Key Vault (*.vault.azure.net)" - // +kubebuilder:validation:XValidation:rule="url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL path must be /keys/ or /keys//" + // +kubebuilder:validation:MaxLength=210 + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` } @@ -358,9 +353,7 @@ type HCPEtcdBackupConfigAzure struct { // "https://.vault.azure.net/keys/[/]". // +required // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=512 - // +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() == 'https'",message="encryptionKeyURL must be a valid HTTPS URL" - // +kubebuilder:validation:XValidation:rule="url(self).getHostname().matches('[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net$')",message="encryptionKeyURL must point to an Azure Key Vault (*.vault.azure.net)" - // +kubebuilder:validation:XValidation:rule="url(self).getEscapedPath().matches('^/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL path must be /keys/ or /keys//" + // +kubebuilder:validation:MaxLength=210 + // +kubebuilder:validation:XValidation:rule="self.matches('^https://[a-zA-Z0-9-]+\\\\.vault\\\\.azure\\\\.net/keys/[a-zA-Z0-9-]+(/[a-zA-Z0-9]+)?$')",message="encryptionKeyURL must be a valid Azure Key Vault HTTPS URL (https://.vault.azure.net/keys/[/])" EncryptionKeyURL string `json:"encryptionKeyURL,omitempty"` }