Merge pull request GoogleCloudPlatform#2287 from jingyih/validate_gsa…

…_format

Validate format of GoogleServiceAccount in CCC

operator/pkg/preflight/configconnectorcontextchecker.go

@@ -17,6 +17,7 @@ package preflight
 import (
 	"context"
 	"fmt"
+	"regexp"
 
 	corev1beta1 "github.com/GoogleCloudPlatform/k8s-config-connector/operator/pkg/apis/core/v1beta1"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/operator/pkg/k8s"
@@ -52,5 +53,21 @@ func (c *ConfigConnectorContextChecker) Preflight(_ context.Context, o declarati
 		return fmt.Errorf("spec.billingProject must be set if spec.requestProjectPolicy is set to %v", k8s.BillingProjectPolicy)
 	}
 
+	if err := validateGSAFormat(ccc.Spec.GoogleServiceAccount); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func validateGSAFormat(gsa string) error {
+	if gsa == "" { // GoogleServiceAccount is a required field. We do not need to fail here.
+		return nil
+	}
+	validGSAPattern := `^[A-Za-z0-9._%+\-]+@[a-z0-9.\-]+\.gserviceaccount.com$`
+	emailRegex := regexp.MustCompile(validGSAPattern)
+	if !emailRegex.MatchString(gsa) {
+		return fmt.Errorf("invalid GoogleServiceAccount format for %q", gsa)
+	}
 	return nil
 }

operator/pkg/preflight/configconnectorcontextchecker_test.go

@@ -169,3 +169,49 @@ func TestConfigConnectorContextChecker(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateGSAFormat(t *testing.T) {
+	tests := []struct {
+		name string
+		gsa  string
+		err  error
+	}{
+		{
+			name: "empty",
+			gsa:  "",
+			err:  nil,
+		},
+		{
+			name: "valid GSA format",
+			gsa:  "[email protected]",
+			err:  nil,
+		},
+		{
+			name: "valid GSA format",
+			gsa:  "[email protected]",
+			err:  nil,
+		},
+		{
+			name: "valid GSA format",
+			gsa:  "[email protected]",
+			err:  nil,
+		},
+		{
+			name: "invalid GSA format",
+			gsa:  "abc",
+			err:  fmt.Errorf("invalid GoogleServiceAccount format for %q", "abc"),
+		},
+		{
+			name: "invalid GSA format",
+			gsa:  "[email protected]",
+			err:  fmt.Errorf("invalid GoogleServiceAccount format for %q", "[email protected]"),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateGSAFormat(tc.gsa)
+			asserts.AssertErrorIsExpected(t, err, tc.err)
+		})
+	}
+}