[apiserver] validate DomainRecord metadata.name matches derived name

PrepareForCreate now only sets metadata.name when the user omits it.
When explicitly provided, Validate rejects names that don't match the
expected derived form (spec.name + target field key).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: dilyevsky

api/core/v1alpha3/domainrecord_validate.go

@@ -22,16 +22,13 @@ func (r *DomainRecord) Default() {
 
 var _ resourcestrategy.PrepareForCreater = &DomainRecord{}
 
-// PrepareForCreate generates metadata.name from spec.name and the target field key.
+// PrepareForCreate derives metadata.name from spec when the user omits it.
 func (r *DomainRecord) PrepareForCreate(ctx context.Context) {
-	suffix := "ref"
-	if r.Spec.Target.DNS != nil {
-		if key := r.Spec.Target.DNS.DNSFieldKey(); key != "" {
-			suffix = key
-		}
-	}
-	r.Name = fmt.Sprintf("%s--%s", r.Spec.Name, suffix)
 	r.GenerateName = ""
+	if r.Name != "" {
+		return // user provided a name; Validate will check it
+	}
+	r.Name = r.derivedName()
 }
 
 var _ resourcestrategy.Validater = &DomainRecord{}
@@ -74,6 +71,21 @@ func (r *DomainRecord) ValidateUpdate(ctx context.Context, obj runtime.Object) f
 	return errs
 }
 
+// derivedName returns the expected metadata.name for the record,
+// derived from spec.name and the target field key.
+func (r *DomainRecord) derivedName() string {
+	if r.Spec.Name == "" {
+		return ""
+	}
+	suffix := "ref"
+	if r.Spec.Target.DNS != nil {
+		if key := r.Spec.Target.DNS.DNSFieldKey(); key != "" {
+			suffix = key
+		}
+	}
+	return fmt.Sprintf("%s--%s", r.Spec.Name, suffix)
+}
+
 // targetFieldKey returns the target field key for a DomainRecord.
 func targetFieldKey(r *DomainRecord) string {
 	if r.Spec.Target.Ref != nil {
@@ -105,6 +117,16 @@ func (r *DomainRecord) validate() field.ErrorList {
 		}
 	}
 
+	// metadata.name must match the derived name when explicitly set.
+	expectedName := r.derivedName()
+	if expectedName != "" && r.Name != expectedName {
+		errs = append(errs, field.Invalid(
+			field.NewPath("metadata", "name"),
+			r.Name,
+			fmt.Sprintf("must be %q (derived from spec)", expectedName),
+		))
+	}
+
 	// TTL range validation.
 	if r.Spec.TTL != nil {
 		if *r.Spec.TTL < 0 || *r.Spec.TTL > 86400 {