Fix CEL validations for parentRefs and use 'in' operator in some CEL expressions

[gauravkghildiyal]

What type of PR is this?
/kind feature
/kind bug
/kind cleanup
/kind test

What this PR does / why we need it:
Fix CEL validations for parentRefs and use 'in' operator in some CEL expressions

Which issue(s) this PR fixes:

Addresses comments:

• v0.8.0 API Review #2245 (comment)
• v0.8.0 API Review #2245 (comment)

Does this PR introduce a user-facing change?:

NONE

---

Explanation for future reference:

The validations in this PR are meant to cover the webhook validations:

gateway-api/apis/v1beta1/validation/common.go

Line 28 in 73f20f4

func ValidateParentRefs(parentRefs []gatewayv1b1.ParentReference, path *field.Path) field.ErrorList {

The validation is split apart into Standard and Experimental (as Port field is currently only available in Experimental). Each of them have two validations:

1. sectionName must be specified when parentRefs includes 2 or more references to the same parent

CEL Playground:

• Standard
• Experimental

The aim of this validation is to ensure that if two references are to the same parent, then:

• Either ALL of them don't have a sectionName (Overall, this is not a valid configuration and will be caught as part of validation number 2 for uniqueness).
• Or ALL of them have a non-empty sectionName.

VALID:

# All have some section name (although all are exactly the same)
self:
    - group: 'example1.org'
      kind: 'Widget'
      name: 'mywidget'
      __namespace__: 'test'
      sectionName: "abc"

    - group: 'example1.org'
      kind: 'Widget'
      name: 'mywidget'
      __namespace__: 'test'
      sectionName: "abc"

# None have a sectionName
self:
    - group: 'example1.org'
      kind: 'Widget'
      name: 'mywidget'
      __namespace__: 'test'
    - group: 'example1.org'
      kind: 'Widget'
      name: 'mywidget'
      __namespace__: 'test'

INVALID:

# One has section name while other doesn't
self:
    - group: 'example1.org'
      kind: 'Widget'
      name: 'mywidget'
      __namespace__: 'test'

    - group: 'example1.org'
      kind: 'Widget'
      name: 'mywidget'
      __namespace__: 'test'
      sectionName: "abc"

2. sectionName must be unique when parentRefs includes 2 or more references to the same parent

CEL Playground:

• Standard
• Experimental

This only tries to guarantee that the combination of all fields within parentRefs is unique.

Something like below is VALID here, but would be considered INVALID for the previous validation

# Both are unique based on their `sectionName`
self:
    - group: 'example1.org'
      kind: 'Widget'
      name: 'mywidget'
      __namespace__: 'test'

    - group: 'example1.org'
      kind: 'Widget'
      name: 'mywidget'
      __namespace__: 'test'
      sectionName: "abc"

[gauravkghildiyal]

Added some explanation in the description and created #2325 to track adding something within our code.

[robscott]

Thanks for all the work on this @gauravkghildiyal! Definitely appreciate the detailed explanation of the validation here and the follow up issues stemming from this PR.

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gauravkghildiyal, robscott

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [robscott]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment