[Add] CEL rules for validating App and PackageInstall Spec

This PR:
- Adds KB marker to ensure that either spec.ServiceAccount
  or spec.Cluster is present in App and PackageInstall CR.
- Bumps controller-tools to 0.10.0 to support CEL based
  validation marker. That is the latest version compatible with
  the k8s release the project is currently at.

Signed-off-by: Varsha Prasad Narsing <[email protected]>

Author: varshaprasad96

config/config/crds.yml

@@ -690,6 +690,9 @@ spec:
                           type: object
                         type: array
                     type: object
+                    x-kubernetes-validations:
+                    - message: Expected service account or cluster.
+                      rule: has(self.serviceAccountName) || has(self.cluster)
                 required:
                 - spec
                 type: object
@@ -1306,6 +1309,9 @@ spec:
                   type: object
                 type: array
             type: object
+            x-kubernetes-validations:
+            - message: Expected service account or cluster.
+              rule: has(self.serviceAccountName) || has(self.cluster)
           status:
             properties:
               conditions:
@@ -1555,6 +1561,9 @@ spec:
                   type: object
                 type: array
             type: object
+            x-kubernetes-validations:
+            - message: Expected service account or cluster.
+              rule: has(self.serviceAccountName) || has(self.cluster)
           status:
             properties:
               conditions:

go.mod

@@ -22,7 +22,7 @@ require (
 	k8s.io/kube-aggregator v0.22.17
 	k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1
 	sigs.k8s.io/controller-runtime v0.13.1
-	sigs.k8s.io/controller-tools v0.7.0
+	sigs.k8s.io/controller-tools v0.10.0
 	sigs.k8s.io/yaml v1.3.0
 )
 
@@ -61,7 +61,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.19.6 // indirect
 	github.com/go-openapi/swag v0.19.15 // indirect
-	github.com/gobuffalo/flect v0.2.3 // indirect
+	github.com/gobuffalo/flect v0.2.5 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect

go.sum

@@ -44,6 +44,7 @@ type AppList struct {
 }
 
 // +k8s:openapi-gen=true
+// +kubebuilder:validation:XValidation:rule="has(self.serviceAccountName) || has(self.cluster)", message="Expected service account or cluster."
 type AppSpec struct {
 	// Specifies that app should be deployed authenticated via
 	// given service account, found in this namespace (optional; v0.6.0+)

pkg/apis/kappctrl/v1alpha1/generated.proto

@@ -43,6 +43,7 @@ type PackageInstallList struct {
 	Items []PackageInstall `json:"items"`
 }
 
+// +kubebuilder:validation:XValidation:rule="has(self.serviceAccountName) || has(self.cluster)", message="Expected service account or cluster."
 type PackageInstallSpec struct {
 	// Specifies service account that will be used to install underlying package contents
 	// +optional