Implement cel validation proc macro for generated CRDs

- Extend with supported values from docs
- https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules
- Implement as Validated derive macro
- Use the raw Rule for the validated attribute

Signed-off-by: Danil-Grigorev <[email protected]>

examples/crd_derive_schema.rs

@@ -7,7 +7,7 @@ use kube::{
         WatchEvent, WatchParams,
     },
     runtime::wait::{await_condition, conditions},
-    Client, CustomResource, CustomResourceExt,
+    Client, CustomResource, CustomResourceExt, Validated,
 };
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
@@ -19,7 +19,9 @@ use serde::{Deserialize, Serialize};
 // - https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#defaulting
 // - https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#defaulting-and-nullable
 
-#[derive(CustomResource, Serialize, Deserialize, Default, Debug, PartialEq, Eq, Clone, JsonSchema)]
+#[derive(
+    CustomResource, Validated, Serialize, Deserialize, Default, Debug, PartialEq, Eq, Clone, JsonSchema,
+)]
 #[kube(
     group = "clux.dev",
     version = "v1",
@@ -85,9 +87,15 @@ pub struct FooSpec {
     #[serde(default)]
     #[schemars(schema_with = "set_listable_schema")]
     set_listable: Vec<u32>,
+
     // Field with CEL validation
     #[serde(default)]
-    #[schemars(schema_with = "cel_validations")]
+    #[validated(
+        method = cel_validated,
+        rule = Rule{rule: "self != 'illegal'".into(), message: Some(Message::Expression("'string cannot be illegal'".into())), reason: Some(Reason::FieldValueForbidden), ..Default::default()},
+        rule = Rule{rule: "self != 'not legal'".into(), reason: Some(Reason::FieldValueInvalid), ..Default::default()}
+    )]
+    #[schemars(schema_with = "cel_validated")]
     cel_validated: Option<String>,
 }
 // https://kubernetes.io/docs/reference/using-api/server-side-apply/#merge-strategy
@@ -104,18 +112,6 @@ fn set_listable_schema(_: &mut schemars::gen::SchemaGenerator) -> schemars::sche
     .unwrap()
 }
 
-// https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules
-fn cel_validations(_: &mut schemars::gen::SchemaGenerator) -> schemars::schema::Schema {
-    serde_json::from_value(serde_json::json!({
-        "type": "string",
-        "x-kubernetes-validations": [{
-            "rule": "self != 'illegal'",
-            "message": "string cannot be illegal"
-        }]
-    }))
-    .unwrap()
-}
-
 fn default_value() -> String {
     "default_value".into()
 }
@@ -243,11 +239,34 @@ async fn main() -> Result<()> {
             assert_eq!(err.reason, "Invalid");
             assert_eq!(err.status, "Failure");
             assert!(err.message.contains("Foo.clux.dev \"baz\" is invalid"));
-            assert!(err.message.contains("spec.cel_validated: Invalid value"));
+            assert!(err.message.contains("spec.cel_validated: Forbidden"));
             assert!(err.message.contains("string cannot be illegal"));
         }
         _ => panic!(),
     }
+
+    // cel validation triggers:
+    let cel_patch = serde_json::json!({
+        "apiVersion": "clux.dev/v1",
+        "kind": "Foo",
+        "spec": {
+            "cel_validated": Some("not legal")
+        }
+    });
+    let cel_res = foos.patch("baz", &ssapply, &Patch::Apply(cel_patch)).await;
+    assert!(cel_res.is_err());
+    match cel_res.err() {
+        Some(kube::Error::Api(err)) => {
+            assert_eq!(err.code, 422);
+            assert_eq!(err.reason, "Invalid");
+            assert_eq!(err.status, "Failure");
+            assert!(err.message.contains("Foo.clux.dev \"baz\" is invalid"));
+            assert!(err.message.contains("spec.cel_validated: Invalid value"));
+            assert!(err.message.contains("failed rule: self != 'not legal'"));
+        }
+        _ => panic!(),
+    }
+
     // cel validation happy:
     let cel_patch_ok = serde_json::json!({
         "apiVersion": "clux.dev/v1",

kube-core/src/lib.rs

@@ -25,6 +25,9 @@ pub use dynamic::{ApiResource, DynamicObject};
 pub mod crd;
 pub use crd::CustomResourceExt;
 
+pub mod validation;
+pub use validation::{validate, Message, Reason, Rule};
+
 pub mod gvk;
 pub use gvk::{GroupVersion, GroupVersionKind, GroupVersionResource};
 

kube-core/src/validation.rs

@@ -0,0 +1,118 @@
+//! CEL validation for CRDs
+
+use std::str::FromStr;
+
+use schemars::schema::Schema;
+use serde::{Deserialize, Serialize};
+use serde_json::Error;
+
+/// Rule is a CEL validation rule for the CRD field
+#[derive(Default, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct Rule {
+    /// rule represents the expression which will be evaluated by CEL.
+    /// The `self` variable in the CEL expression is bound to the scoped value.
+    pub rule: String,
+    /// message represents CEL validation message for the provided type
+    /// If unset, the message is "failed rule: {Rule}".
+    #[serde(flatten)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<Message>,
+    /// fieldPath represents the field path returned when the validation fails.
+    /// It must be a relative JSON path, scoped to the location of the field in the schema
+    pub field_path: Option<String>,
+    /// reason is a machine-readable value providing more detail about why a field failed the validation.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<Reason>,
+}
+
+/// Message represents CEL validation message for the provided type
+#[derive(Serialize, Deserialize, Clone)]
+#[serde(rename_all = "lowercase")]
+pub enum Message {
+    /// Message represents the message displayed when validation fails. The message is required if the Rule contains
+    /// line breaks. The message must not contain line breaks.
+    /// Example:
+    /// "must be a URL with the host matching spec.host"
+    Message(String),
+    /// Expression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.
+    /// Since messageExpression is used as a failure message, it must evaluate to a string. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
+    /// as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string
+    /// that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and
+    /// the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged.
+    /// messageExpression has access to all the same variables as the rule; the only difference is the return type.
+    /// Example:
+    /// "x must be less than max ("+string(self.max)+")"
+    #[serde(rename = "messageExpression")]
+    Expression(String),
+}
+
+impl From<&str> for Message {
+    fn from(value: &str) -> Self {
+        Message::Message(value.to_string())
+    }
+}
+
+/// Reason is a machine-readable value providing more detail about why a field failed the validation.
+///
+/// More in [docs](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#field-reason)
+#[derive(Serialize, Deserialize, Clone)]
+pub enum Reason {
+    /// FieldValueInvalid is used to report malformed values (e.g. failed regex
+    /// match, too long, out of bounds).
+    FieldValueInvalid,
+    /// FieldValueForbidden is used to report valid (as per formatting rules)
+    /// values which would be accepted under some conditions, but which are not
+    /// permitted by the current conditions (such as security policy).
+    FieldValueForbidden,
+    /// FieldValueRequired is used to report required values that are not
+    /// provided (e.g. empty strings, null values, or empty arrays).
+    FieldValueRequired,
+    /// FieldValueDuplicate is used to report collisions of values that must be
+    /// unique (e.g. unique IDs).
+    FieldValueDuplicate,
+}
+
+impl FromStr for Reason {
+    type Err = serde_json::Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        serde_json::from_str(s)
+    }
+}
+
+/// validate takes schema and applies a set of validation rules to it. The rules are stored
+/// under the "x-kubernetes-validations".
+///
+/// ```rust
+/// use schemars::schema::Schema;
+/// use kube_core::{Rule, Reason, Message, validate};
+///
+/// let mut schema = Schema::Object(Default::default());
+/// let rules = vec![Rule{
+///     rule: "self.spec.host == self.url.host".into(),
+///     message: Some("must be a URL with the host matching spec.host".into()),
+///     field_path: Some("spec.host".into()),
+///     ..Default::default()
+/// }];
+/// let schema = validate(&mut schema, rules)?;
+/// assert_eq!(
+///     serde_json::to_string(&schema).unwrap(),
+///     r#"{"x-kubernetes-validations":[{"fieldPath":"spec.host","message":"must be a URL with the host matching spec.host","rule":"self.spec.host == self.url.host"}]}"#,
+/// );
+/// # Ok::<(), serde_json::Error>(())
+///```
+#[cfg(feature = "schema")]
+pub fn validate(s: &mut Schema, rules: Vec<Rule>) -> Result<Schema, Error> {
+    let rules = serde_json::to_value(rules)?;
+    match s {
+        Schema::Bool(_) => (),
+        Schema::Object(schema_object) => {
+            schema_object
+                .extensions
+                .insert("x-kubernetes-validations".into(), rules);
+        }
+    };
+
+    Ok(s.clone())
+}

kube-derive/src/custom_resource.rs

@@ -1,10 +1,17 @@
 // Generated by darling macros, out of our control
 #![allow(clippy::manual_unwrap_or_default)]
+use std::collections::BTreeMap;
 
-use darling::{FromDeriveInput, FromMeta};
+use darling::{
+    ast,
+    util::{self, path_to_string, IdentString},
+    FromAttributes, FromDeriveInput, FromField, FromMeta,
+};
 use proc_macro2::{Ident, Literal, Span, TokenStream};
-use quote::{ToTokens, TokenStreamExt};
-use syn::{parse_quote, Data, DeriveInput, Path, Visibility};
+use quote::{ToTokens, TokenStreamExt as _};
+use syn::{
+    parse_quote, spanned::Spanned, Attribute, Data, DeriveInput, Expr, ExprCall, Path, Stmt, Type, Visibility,
+};
 
 /// Values we can parse from #[kube(attrs)]
 #[derive(Debug, FromDeriveInput)]
@@ -201,6 +208,7 @@ pub(crate) fn derive(input: proc_macro2::TokenStream) -> proc_macro2::TokenStrea
             .to_compile_error()
         }
     }
+
     let kube_attrs = match KubeAttrs::from_derive_input(&derive_input) {
         Err(err) => return err.write_errors(),
         Ok(attrs) => attrs,
@@ -629,6 +637,76 @@ fn generate_hasspec(spec_ident: &Ident, root_ident: &Ident, kube_core: &Path) ->
     }
 }
 
+#[derive(FromField)]
+#[darling(attributes(validated))]
+struct Rule {
+    ident: Option<Ident>,
+    ty: Type,
+    method: Option<Path>,
+    #[darling(multiple, rename = "rule")]
+    rules: Vec<Expr>,
+}
+
+#[derive(FromDeriveInput)]
+#[darling(supports(struct_named))]
+struct CELValidation {
+    #[darling(default)]
+    crates: Crates,
+    data: ast::Data<util::Ignored, Rule>,
+}
+
+pub(crate) fn derive_validated(input: TokenStream) -> TokenStream {
+    let ast: DeriveInput = match syn::parse2(input) {
+        Err(err) => return err.to_compile_error(),
+        Ok(di) => di,
+    };
+
+    let CELValidation {
+        crates: Crates {
+            kube_core, schemars, ..
+        },
+        data,
+        ..
+    } = match CELValidation::from_derive_input(&ast) {
+        Err(err) => return err.write_errors(),
+        Ok(attrs) => attrs,
+    };
+
+    let mut validations: Vec<TokenStream> = vec![];
+
+    let fields = data.take_struct().map(|f| f.fields).unwrap_or_default();
+    for rule in fields.iter().filter(|r| !r.rules.is_empty()) {
+        let Rule {
+            rules,
+            ident,
+            ty,
+            method,
+        } = rule;
+        let rules: Vec<TokenStream> = rules.iter().map(|r| quote! {#r,}).collect();
+        let method = match method {
+            Some(method) => method.to_token_stream(),
+            None => match ident {
+                Some(ident) => IdentString::new(ident.clone()).to_token_stream(),
+                None => {
+                    return syn::Error::new(
+                        Span::call_site(),
+                        r#"Validated can be used only on named sctuctures"#,
+                    )
+                    .to_compile_error()
+                }
+            },
+        };
+        validations.push(quote! {
+            fn #method(gen: &mut #schemars::gen::SchemaGenerator) -> #schemars::schema::Schema {
+                use #kube_core::{Rule, Message, Reason};
+                #kube_core::validate(&mut gen.subschema_for::<#ty>(), [#(#rules)*].to_vec()).unwrap()
+            }
+        });
+    }
+
+    quote! {#(#validations)*}
+}
+
 struct StatusInformation {
     /// The code to be used for the field in the main struct
     field: TokenStream,

kube-derive/src/lib.rs

@@ -327,6 +327,35 @@ pub fn derive_custom_resource(input: proc_macro::TokenStream) -> proc_macro::Tok
     custom_resource::derive(proc_macro2::TokenStream::from(input)).into()
 }
 
+/// Generates a JsonSchema patch with a set of CEL expression validation rules applied on the CRD.
+///
+/// # Example
+///
+/// ```rust
+/// use kube::Validated;
+/// use kube::CustomResource;
+/// use serde::Deserialize;
+/// use serde::Serialize;
+/// use schemars::JsonSchema;
+/// use kube::core::crd::CustomResourceExt;
+///
+/// #[derive(CustomResource, Validated, Serialize, Deserialize, Clone, Debug, JsonSchema)]
+/// #[kube(group = "kube.rs", version = "v1", kind = "Struct")]
+/// struct MyStruct {
+///     #[validated(rule = Rule{rule: "self != ''".into(), message: Some("failure message".into()), ..Default::default()})]
+///     #[schemars(schema_with = "field")]
+///     field: String,
+/// }
+///
+/// assert!(serde_json::to_string(&Struct::crd()).unwrap().contains("x-kubernetes-validations"));
+/// assert!(serde_json::to_string(&Struct::crd()).unwrap().contains(r#""rule":"self != ''""#));
+/// assert!(serde_json::to_string(&Struct::crd()).unwrap().contains(r#""message":"failure message""#));
+/// ```
+#[proc_macro_derive(Validated, attributes(validated, schemars))]
+pub fn derive_validated(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
+    custom_resource::derive_validated(input.into()).into()
+}
+
 /// A custom derive for inheriting Resource impl for the type.
 ///
 /// This will generate a [`kube::Resource`] trait implementation,

kube/src/lib.rs

@@ -168,6 +168,10 @@ pub use kube_derive::CustomResource;
 #[cfg_attr(docsrs, doc(cfg(feature = "derive")))]
 pub use kube_derive::Resource;
 
+#[cfg(feature = "derive")]
+#[cfg_attr(docsrs, doc(cfg(feature = "derive")))]
+pub use kube_derive::Validated;
+
 #[cfg(feature = "runtime")]
 #[cfg_attr(docsrs, doc(cfg(feature = "runtime")))]
 #[doc(inline)]