Skip to content

Check policies strictly with kubernetes's validation - #16

Merged
superbrothers merged 3 commits into
pfnet:mainfrom
naoki9911:check-vap
Nov 7, 2025
Merged

Check policies strictly with kubernetes's validation#16
superbrothers merged 3 commits into
pfnet:mainfrom
naoki9911:check-vap

Conversation

@naoki9911

@naoki9911 naoki9911 commented Oct 9, 2025

Copy link
Copy Markdown
Collaborator

This PR introduces more stringent policy validation using Kubernetes's built-in validation mechanisms.
CEL expression validation is performed during compilation, and if compilation fails, appropriate error messages are generated.
The validation error example is as follows.

[VAP] FAIL: deployment-replicas - (CREATE) Deployment:not-exist/ok - ADMIT ==> SETUP ERROR
--- ERROR: spec.matchConstraints.matchPolicy: Required value
--- ERROR: spec.matchConstraints.namespaceSelector: Required value
--- ERROR: spec.matchConstraints.objectSelector: Required value
--- ERROR: spec.validations[0].messageExpression: Invalid value: "'replicas must be equal or less than ' + variables.maxReplicas": compilation failed: ERROR: <input>:1:40: found no matching overload for '_+_' applied to '(string, int)'
 | 'replicas must be equal or less than ' + variables.maxReplicas
 | .......................................^

Changes

  • More strict validation. This may cause error with some policies which previously passes tests.

@naoki9911
naoki9911 marked this pull request as ready for review October 30, 2025 06:19
@superbrothers
superbrothers merged commit 03a5e0d into pfnet:main Nov 7, 2025
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants