Add validations for NetworkPeeringClaimRef fields of Network type

go.mod

@@ -56,6 +56,7 @@ require (
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
+	github.com/gofrs/uuid v4.4.0+incompatible
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/cel-go v0.17.7 // indirect

go.sum

@@ -68,6 +68,8 @@ github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
+github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=

internal/apis/networking/validation/network.go

@@ -4,6 +4,7 @@
 package validation
 
 import (
+	"github.com/gofrs/uuid"
 	ironcorevalidation "github.com/ironcore-dev/ironcore/internal/api/validation"
 	"github.com/ironcore-dev/ironcore/internal/apis/networking"
 	apivalidation "k8s.io/apimachinery/pkg/api/validation"
@@ -54,6 +55,29 @@ func validateNetworkSpec(namespace, name string, spec *networking.NetworkSpec, f
 		allErrs = append(allErrs, validateNetworkPeering(peering, fldPath)...)
 	}
 
+	seenPeeringClaimRefKeys := sets.New[client.ObjectKey]()
+
+	for i, peeringClaimRef := range spec.PeeringClaimRefs {
+		fldPath := fldPath.Child("incomingPeerings").Index(i)
+
+		peeringClaimRefNamespace := peeringClaimRef.Namespace
+		if peeringClaimRefNamespace == "" {
+			peeringClaimRefNamespace = namespace
+		}
+
+		peeringClaimRefkKey := client.ObjectKey{Namespace: peeringClaimRefNamespace, Name: peeringClaimRef.Name}
+
+		if name != "" && (client.ObjectKey{Namespace: namespace, Name: name}) == peeringClaimRefkKey {
+			allErrs = append(allErrs, field.Forbidden(fldPath, "cannot claim itself"))
+		} else if seenPeeringClaimRefKeys.Has(peeringClaimRefkKey) {
+			allErrs = append(allErrs, field.Duplicate(fldPath, peeringClaimRef))
+		} else {
+			seenPeeringClaimRefKeys.Insert(peeringClaimRefkKey)
+		}
+
+		allErrs = append(allErrs, validatePeeringClaimRef(peeringClaimRef, fldPath)...)
+	}
+
 	return allErrs
 }
 
@@ -77,6 +101,35 @@ func validateNetworkPeering(peering networking.NetworkPeering, fldPath *field.Pa
 	return allErrs
 }
 
+func validatePeeringClaimRef(peeringClaimRef networking.NetworkPeeringClaimRef, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+
+	if len(peeringClaimRef.Name) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("name"), "name is required"))
+	} else {
+		for _, msg := range apivalidation.NameIsDNSLabel(peeringClaimRef.Name, false) {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), peeringClaimRef.Name, msg))
+		}
+	}
+
+	if peeringClaimRef.Namespace != "" {
+		for _, msg := range apivalidation.NameIsDNSLabel(peeringClaimRef.Namespace, false) {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("namespace"), peeringClaimRef.Namespace, msg))
+		}
+	}
+
+	if peeringClaimRef.UID != "" && !isValidUID(string(peeringClaimRef.UID)) {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("uid"), peeringClaimRef.UID, "invalid uid"))
+	}
+
+	return allErrs
+}
+
+func isValidUID(u string) bool {
+	_, err := uuid.FromString(u)
+	return err == nil
+}
+
 // ValidateNetworkUpdate validates a Network object before an update.
 func ValidateNetworkUpdate(newNetwork, oldNetwork *networking.Network) field.ErrorList {
 	var allErrs field.ErrorList

internal/apis/networking/validation/network_test.go

@@ -68,6 +68,62 @@ var _ = Describe("Network", func() {
 			},
 			ContainElement(DuplicateField("spec.peerings[1].networkRef")),
 		),
+		Entry("peering claim references itself",
+			&networking.Network{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "ns", Name: "foo"},
+				Spec: networking.NetworkSpec{
+					PeeringClaimRefs: []networking.NetworkPeeringClaimRef{
+						{
+							Name:      "foo",
+							Namespace: "ns",
+						},
+					},
+				},
+			},
+			ContainElement(ForbiddenField("spec.incomingPeerings[0]")),
+		),
+		Entry("duplicate peering claim ref",
+			&networking.Network{
+				Spec: networking.NetworkSpec{
+					PeeringClaimRefs: []networking.NetworkPeeringClaimRef{
+						{Name: "bar"},
+						{Name: "bar"},
+					},
+				},
+			},
+			ContainElement(DuplicateField("spec.incomingPeerings[1]")),
+		),
+		Entry("invalid peering claim ref name",
+			&networking.Network{
+				Spec: networking.NetworkSpec{
+					PeeringClaimRefs: []networking.NetworkPeeringClaimRef{
+						{Name: "bar*"},
+					},
+				},
+			},
+			ContainElement(InvalidField("spec.incomingPeerings[0].name")),
+		),
+		Entry("invalid peering claim ref namespace",
+			&networking.Network{
+				Spec: networking.NetworkSpec{
+					PeeringClaimRefs: []networking.NetworkPeeringClaimRef{
+						{Namespace: "ns*"},
+					},
+				},
+			},
+			ContainElements(InvalidField("spec.incomingPeerings[0].namespace"),
+				RequiredField("spec.incomingPeerings[0].name")),
+		),
+		Entry("invalid peering claim ref uid",
+			&networking.Network{
+				Spec: networking.NetworkSpec{
+					PeeringClaimRefs: []networking.NetworkPeeringClaimRef{
+						{UID: "978978-dsfdff"},
+					},
+				},
+			},
+			ContainElements(InvalidField("spec.incomingPeerings[0].uid")),
+		),
 	)
 
 	DescribeTable("ValidateNetworkUpdate",