Remove Webhooks in Favor of OpenAPI/CEL CRD Validation

[dudicoco]

Hi,

I'm trying to understand the benefits which the Karpenter webhooks provide.

Looking at the validating webhook code it seems that the same validation could be done via the CRD schema.

The defaulting webhook doesn't seem to do anything at all. In addition, you can add default values to the CRD schema.

[ellistarn]

We haven't gone through the exercise of using builtin CRD validation. The defaults are provider specific. See: https://github.com/aws/karpenter/blob/main/pkg/apis/v1alpha5/provisioner.go#L45. I'd be curious to see if you could replace the validation webhooks.

[dudicoco]

We haven't gone through the exercise of using builtin CRD validation.

@ellistarn can you please elaborate on that?
It is much easier to add some fields to the CRD schema than writing additional code to validate it.
For example the following code could be easily replaced with a required: ["evictionSoftGracePeriod"] block within the schema.

I believe the defaulting webhook could also be avoided by adding default fields within the CRD schema.

[ellistarn]

Interesting ideas. Would you be interested in contributing this?

[dudicoco]

@ellistarn sure.
Should I open a PR for the CRDs changes?

[ellistarn]

Sure thing!

[github-actions]

Labeled for closure due to inactivity in 10 days.

[github-actions]

Labeled for closure due to inactivity in 10 days.

[jonathan-innis]

Kubernetes supports CEL for CRD validation. We should investigate this along with the other validations that are supported natively by the Open API specs (like defaults, minimum, maximums, etc.)