Docker & Kubernetes
Validation
Learn CRD validation rules.
Validation
A CRD's openAPIV3Schema validates on the API server: types, required fields, limits, allowed values. An invalid object is rejected before being saved; the controller is spared from dealing with broken data:
spec:
type: object
required: [veritabani, takvim]
properties:
veritabani: {type: string, minLength: 1}
takvim: {type: string, pattern: "^[0-9*/,-]+( [0-9*/,-]+){4}$"}
saklamaGun: {type: integer, minimum: 1, maximum: 365, default: 7}
tur: {type: string, enum: [tam, artimli]}
CEL rules
For cross-field rules, CEL expressions (x-kubernetes-validations) are written into the validation definition. Complex validation can be done without writing a webhook:
spec:
type: object
x-kubernetes-validations:
- rule: "self.tur != 'artimli' || self.saklamaGun <= 30"
message: "artımlı yedekler en fazla 30 gün saklanır"
$ kubectl apply -f yedek.yaml
The Yedek "magaza-gece" is invalid: spec: Invalid value: artımlı yedekler en fazla 30 gün saklanır
Exercise Tighten the validation
Write the spec property of a CRD validation definition (starting with spec:): type: object; required: [veritabani, takvim]; under properties, veritabani (type: string), takvim (type: string) and saklamaGun (type: integer, minimum: 1, maximum: 365).
Show example solution
spec:
type: object
required: [veritabani, takvim]
properties:
veritabani:
type: string
takvim:
type: string
saklamaGun:
type: integer
minimum: 1
maximum: 365
Test yourself
-
What happens if a Yedek with saklamaGun: 500 is applied?
- The API server rejects it with "must be less than or equal to 365"
- It's clipped to 365
- It's saved and the controller fixes it
- It's ignored
Show answer
The API server rejects it with "must be less than or equal to 365" — Validation happens before saving.
-
Specify the required fields.
spec:
type: object
____: [veritabani, takvim]
Show answer
spec:
type: object
required: [veritabani, takvim]
-
Match.
- required
- Required fields
- minimum/maximum
- Number limits
- enum
- Allowed values
- x-kubernetes-validations
- CEL rule
Next lesson: Summary - CRD
