Skip to content

OperatorConfig CEL Validation #1957

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
bernot-dev wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

OperatorConfig CEL Validation #1957

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
00e979f
feat: implement CEL validations for OperatorConfig
bernot-dev Apr 10, 2026
e5d8bdc
test: add fuzzing of operatorconfig validation
bernot-dev Jun 25, 2026
aba2056
fix: reinstate pre-existing compression validation
bernot-dev Jun 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 41 additions & 6 deletions charts/operator/crds/monitoring.googleapis.com_operatorconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,9 +46,6 @@ spec:
compression:
description: Compression enables compression of metrics collection
data
enum:
- none
- gzip
type: string
credentials:
description: |-
Expand Down Expand Up @@ -78,6 +75,9 @@ spec:
- key
type: object
x-kubernetes-map-type: atomic
x-kubernetes-validations:
- message: missing secret key selector name
rule: has(self.name) && self.name != ''
externalLabels:
additionalProperties:
type: string
Comment thread
bernot-dev marked this conversation as resolved.
Expand Down Expand Up @@ -136,6 +136,7 @@ spec:
properties:
interval:
description: The interval at which the metric endpoints are scraped.
format: duration
type: string
tlsInsecureSkipVerify:
description: |-
Expand All @@ -156,7 +157,11 @@ spec:
url:
description: The URL of the endpoint that supports Prometheus Remote
Write to export samples to.
format: uri
type: string
x-kubernetes-validations:
- message: url must be a valid URL
rule: self == '' || isURL(self)
required:
- url
type: object
Expand All @@ -173,9 +178,6 @@ spec:
Compression enables compression of the config data propagated by the operator to collectors
and the rule-evaluator. It is recommended to use the gzip option when using a large number of
ClusterPodMonitoring, PodMonitoring, GlobalRules, ClusterRules, and/or Rules.
enum:
- none
- gzip
type: string
type: object
targetStatus:
Expand Down Expand Up @@ -227,6 +229,9 @@ spec:
- key
type: object
x-kubernetes-map-type: atomic
x-kubernetes-validations:
- message: missing secret key selector name
rule: has(self.name) && self.name != ''
externalURL:
description: |-
ExternalURL is the URL under which Alertmanager is externally reachable (for example, if
Expand All @@ -236,7 +241,11 @@ spec:
be derived automatically.

If no URL is provided, Alertmanager will point to the Google Cloud Metric Explorer page.
format: uri
type: string
x-kubernetes-validations:
- message: externalURL must be a valid URL
rule: self == '' || isURL(self)
type: object
metadata:
type: object
Expand Down Expand Up @@ -288,6 +297,9 @@ spec:
- key
type: object
x-kubernetes-map-type: atomic
x-kubernetes-validations:
- message: missing secret key selector name
rule: has(self.name) && self.name != ''
type:
description: |-
Set the authentication type. Defaults to Bearer, Basic will cause an
Expand Down Expand Up @@ -316,6 +328,7 @@ spec:
timeout:
description: Timeout is a per-target Alertmanager timeout
when pushing alerts.
format: duration
type: string
tls:
description: TLS Config to use for alertmanager connection.
Expand Down Expand Up @@ -373,7 +386,13 @@ spec:
- key
type: object
x-kubernetes-map-type: atomic
x-kubernetes-validations:
- message: missing secret key selector name
rule: has(self.name) && self.name != ''
type: object
x-kubernetes-validations:
- message: SecretOrConfigMap fields are mutually exclusive
rule: '!(has(self.secret) && has(self.configMap))'
cert:
description: Struct containing the client cert file
for the targets.
Expand Down Expand Up @@ -427,7 +446,13 @@ spec:
- key
type: object
x-kubernetes-map-type: atomic
x-kubernetes-validations:
- message: missing secret key selector name
rule: has(self.name) && self.name != ''
type: object
x-kubernetes-validations:
- message: SecretOrConfigMap fields are mutually exclusive
rule: '!(has(self.secret) && has(self.configMap))'
insecureSkipVerify:
description: Disable target certificate validation.
type: boolean
Expand Down Expand Up @@ -456,6 +481,9 @@ spec:
- key
type: object
x-kubernetes-map-type: atomic
x-kubernetes-validations:
- message: missing secret key selector name
rule: has(self.name) && self.name != ''
maxVersion:
description: |-
Maximum TLS version. Accepted values: TLS10 (TLS 1.0), TLS11 (TLS 1.1), TLS12 (TLS 1.2), TLS13 (TLS 1.3).
Expand Down Expand Up @@ -508,6 +536,9 @@ spec:
- key
type: object
x-kubernetes-map-type: atomic
x-kubernetes-validations:
- message: missing secret key selector name
rule: has(self.name) && self.name != ''
externalLabels:
additionalProperties:
type: string
Expand All @@ -520,7 +551,11 @@ spec:
description: |-
The base URL used for the generator URL in the alert notification payload.
Should point to an instance of a query frontend that gives access to queryProjectID.
format: uri
type: string
x-kubernetes-validations:
- message: generatorUrl must be a valid URL
rule: self == '' || isURL(self)
queryProjectID:
description: |-
QueryProjectID is the GCP project ID to evaluate rules against.
Expand Down
Loading
Loading