update api validation on minimumKubeletVersion

Signed-off-by: Peter Hunt <[email protected]>

config/v1/tests/nodes.config.openshift.io/MinimumKubeletVersion.yaml

@@ -1,6 +1,7 @@
 apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
 name: "Node"
 crdName: nodes.config.openshift.io
+featureGate: MinimumKubeletVersion
 tests:
   onCreate:
     - name: Should be able to create a minimal Node
@@ -12,3 +13,21 @@ tests:
         apiVersion: config.openshift.io/v1
         kind: Node
         spec: {}
+    - name: Should be able to create a minimumKubeletVersion
+      initial: |
+        apiVersion: config.openshift.io/v1
+        kind: Node
+        spec:
+          minimumKubeletVersion: 1.30.0
+      expected: |
+        apiVersion: config.openshift.io/v1
+        kind: Node
+        spec:
+          minimumKubeletVersion: 1.30.0
+    - name: Should fail to create a bogus version
+      initial: |
+        apiVersion: config.openshift.io/v1
+        kind: Node
+        spec:
+          minimumKubeletVersion: bogus
+      expectedError: "Invalid value: \"string\": minmumKubeletVersion must be in a semver compatible format of x.y.z, or empty"

config/v1/types_node.go

@@ -47,14 +47,24 @@ type NodeSpec struct {
 	// +optional
 	WorkerLatencyProfile WorkerLatencyProfileType `json:"workerLatencyProfile,omitempty"`
 
-	// MinimumKubeletVersion is the lowest version of a kubelet that can meaningfully join the cluster.
+	// minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.
 	// Specifically, the apiserver will deny most authorization requests of kubelets that are older
 	// than the specified version, only allowing the kubelet to get and update its node object, and perform
 	// subjectaccessreviews.
-	// +kubebuilder:validation:Pattern=`^[0-9]*\.[0-9]*\.[0-9]*$`
+	// This means the kubelet won't be able to view API objects it's responsible for running,
+	// and will eventually be marked as NotReady.
+	// Its max length is 8, so maximum version allowed is either "9.999.99" or "99.99.99".
+	// Since the kubelet reports the version of the kubernetes release, not Openshift, this field references
+	// the underlying kubernetes version this version of Openshift is based off of.
+	// In other words: if an admin wishes to ensure no nodes run an older version than Openshift 4.17, then
+	// they should set the minimumKubeletVersion to 1.30.0.
+	// When comparing versions, the kubelet's version is stripped of any contents outside of major.minor.patch version.
+	// Thus, a kubelet with version "1.0.0-ec.0" will be compatible with minimumKubeletVersion "1.0.0" or earlier.
+	// +kubebuilder:validation:XValidation:rule="self == \"\" || self.matches('^[0-9]*.[0-9]*.[0-9]*$')",message="minmumKubeletVersion must be in a semver compatible format of x.y.z, or empty"
+	// +kubebuilder:validation:MaxLength:=8
 	// +openshift:enable:FeatureGate=MinimumKubeletVersion
 	// +optional
-	MinimumKubeletVersion string `json:"minimumKubeletVersion,omitempty"`
+	MinimumKubeletVersion string `json:"minimumKubeletVersion"`
 }
 
 type NodeStatus struct {

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_nodes-CustomNoUpgrade.crd.yaml

@@ -55,12 +55,25 @@ spec:
                 type: string
               minimumKubeletVersion:
                 description: |-
-                  MinimumKubeletVersion is the lowest version of a kubelet that can meaningfully join the cluster.
+                  minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.
                   Specifically, the apiserver will deny most authorization requests of kubelets that are older
                   than the specified version, only allowing the kubelet to get and update its node object, and perform
                   subjectaccessreviews.
-                pattern: ^[0-9]*\.[0-9]*\.[0-9]*$
+                  This means the kubelet won't be able to view API objects it's responsible for running,
+                  and will eventually be marked as NotReady.
+                  Its max length is 8, so maximum version allowed is either "9.999.99" or "99.99.99".
+                  Since the kubelet reports the version of the kubernetes release, not Openshift, this field references
+                  the underlying kubernetes version this version of Openshift is based off of.
+                  In other words: if an admin wishes to ensure no nodes run an older version than Openshift 4.17, then
+                  they should set the minimumKubeletVersion to 1.30.0.
+                  When comparing versions, the kubelet's version is stripped of any contents outside of major.minor.patch version.
+                  Thus, a kubelet with version "1.0.0-ec.0" will be compatible with minimumKubeletVersion "1.0.0" or earlier.
+                maxLength: 8
                 type: string
+                x-kubernetes-validations:
+                - message: minmumKubeletVersion must be in a semver compatible format
+                    of x.y.z, or empty
+                  rule: self == "" || self.matches('^[0-9]*.[0-9]*.[0-9]*$')
               workerLatencyProfile:
                 description: |-
                   WorkerLatencyProfile determins the how fast the kubelet is updating

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_nodes-DevPreviewNoUpgrade.crd.yaml

@@ -55,12 +55,25 @@ spec:
                 type: string
               minimumKubeletVersion:
                 description: |-
-                  MinimumKubeletVersion is the lowest version of a kubelet that can meaningfully join the cluster.
+                  minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.
                   Specifically, the apiserver will deny most authorization requests of kubelets that are older
                   than the specified version, only allowing the kubelet to get and update its node object, and perform
                   subjectaccessreviews.
-                pattern: ^[0-9]*\.[0-9]*\.[0-9]*$
+                  This means the kubelet won't be able to view API objects it's responsible for running,
+                  and will eventually be marked as NotReady.
+                  Its max length is 8, so maximum version allowed is either "9.999.99" or "99.99.99".
+                  Since the kubelet reports the version of the kubernetes release, not Openshift, this field references
+                  the underlying kubernetes version this version of Openshift is based off of.
+                  In other words: if an admin wishes to ensure no nodes run an older version than Openshift 4.17, then
+                  they should set the minimumKubeletVersion to 1.30.0.
+                  When comparing versions, the kubelet's version is stripped of any contents outside of major.minor.patch version.
+                  Thus, a kubelet with version "1.0.0-ec.0" will be compatible with minimumKubeletVersion "1.0.0" or earlier.
+                maxLength: 8
                 type: string
+                x-kubernetes-validations:
+                - message: minmumKubeletVersion must be in a semver compatible format
+                    of x.y.z, or empty
+                  rule: self == "" || self.matches('^[0-9]*.[0-9]*.[0-9]*$')
               workerLatencyProfile:
                 description: |-
                   WorkerLatencyProfile determins the how fast the kubelet is updating

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_nodes-TechPreviewNoUpgrade.crd.yaml

@@ -55,12 +55,25 @@ spec:
                 type: string
               minimumKubeletVersion:
                 description: |-
-                  MinimumKubeletVersion is the lowest version of a kubelet that can meaningfully join the cluster.
+                  minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.
                   Specifically, the apiserver will deny most authorization requests of kubelets that are older
                   than the specified version, only allowing the kubelet to get and update its node object, and perform
                   subjectaccessreviews.
-                pattern: ^[0-9]*\.[0-9]*\.[0-9]*$
+                  This means the kubelet won't be able to view API objects it's responsible for running,
+                  and will eventually be marked as NotReady.
+                  Its max length is 8, so maximum version allowed is either "9.999.99" or "99.99.99".
+                  Since the kubelet reports the version of the kubernetes release, not Openshift, this field references
+                  the underlying kubernetes version this version of Openshift is based off of.
+                  In other words: if an admin wishes to ensure no nodes run an older version than Openshift 4.17, then
+                  they should set the minimumKubeletVersion to 1.30.0.
+                  When comparing versions, the kubelet's version is stripped of any contents outside of major.minor.patch version.
+                  Thus, a kubelet with version "1.0.0-ec.0" will be compatible with minimumKubeletVersion "1.0.0" or earlier.
+                maxLength: 8
                 type: string
+                x-kubernetes-validations:
+                - message: minmumKubeletVersion must be in a semver compatible format
+                    of x.y.z, or empty
+                  rule: self == "" || self.matches('^[0-9]*.[0-9]*.[0-9]*$')
               workerLatencyProfile:
                 description: |-
                   WorkerLatencyProfile determins the how fast the kubelet is updating

config/v1/zz_generated.featuregated-crd-manifests/nodes.config.openshift.io/MinimumKubeletVersion.yaml

@@ -55,12 +55,25 @@ spec:
                 type: string
               minimumKubeletVersion:
                 description: |-
-                  MinimumKubeletVersion is the lowest version of a kubelet that can meaningfully join the cluster.
+                  minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.
                   Specifically, the apiserver will deny most authorization requests of kubelets that are older
                   than the specified version, only allowing the kubelet to get and update its node object, and perform
                   subjectaccessreviews.
-                pattern: ^[0-9]*\.[0-9]*\.[0-9]*$
+                  This means the kubelet won't be able to view API objects it's responsible for running,
+                  and will eventually be marked as NotReady.
+                  Its max length is 8, so maximum version allowed is either "9.999.99" or "99.99.99".
+                  Since the kubelet reports the version of the kubernetes release, not Openshift, this field references
+                  the underlying kubernetes version this version of Openshift is based off of.
+                  In other words: if an admin wishes to ensure no nodes run an older version than Openshift 4.17, then
+                  they should set the minimumKubeletVersion to 1.30.0.
+                  When comparing versions, the kubelet's version is stripped of any contents outside of major.minor.patch version.
+                  Thus, a kubelet with version "1.0.0-ec.0" will be compatible with minimumKubeletVersion "1.0.0" or earlier.
+                maxLength: 8
                 type: string
+                x-kubernetes-validations:
+                - message: minmumKubeletVersion must be in a semver compatible format
+                    of x.y.z, or empty
+                  rule: self == "" || self.matches('^[0-9]*.[0-9]*.[0-9]*$')
               workerLatencyProfile:
                 description: |-
                   WorkerLatencyProfile determins the how fast the kubelet is updating

kubecontrolplane/v1/types.go

@@ -63,12 +63,24 @@ type KubeAPIServerConfig struct {
 	// TODO this needs to be removed.
 	APIServerArguments map[string]Arguments `json:"apiServerArguments"`
 
-	// MinimumKubeletVersion is the lowest version of a kubelet that can meaningfully join the cluster.
+	// minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.
 	// Specifically, the apiserver will deny most authorization requests of kubelets that are older
 	// than the specified version, only allowing the kubelet to get and update its node object, and perform
 	// subjectaccessreviews.
+	// This means the kubelet won't be able to view API objects it's responsible for running,
+	// and will eventually be marked as NotReady.
+	// Its max length is 8, so maximum version allowed is either "9.999.99" or "99.99.99".
+	// Since the kubelet reports the version of the kubernetes release, not Openshift, this field references
+	// the underlying kubernetes version this version of Openshift is based off of.
+	// In other words: if an admin wishes to ensure no nodes run an older version than Openshift 4.17, then
+	// they should set the minimumKubeletVersion to 1.30.0.
+	// When comparing versions, the kubelet's version is stripped of any contents outside of major.minor.patch version.
+	// Thus, a kubelet with version "1.0.0-ec.0" will be compatible with minimumKubeletVersion "1.0.0" or earlier.
+	// +kubebuilder:validation:XValidation:rule="self == \"\" || self.matches('^[0-9]*.[0-9]*.[0-9]*$')",message="minmumKubeletVersion must be in a semver compatible format of x.y.z, or empty"
+	// +kubebuilder:validation:MaxLength:=8
 	// +openshift:enable:FeatureGate=MinimumKubeletVersion
-	MinimumKubeletVersion string `json:"minimumKubeletVersion,omitempty"`
+	// +optional
+	MinimumKubeletVersion string `json:"minimumKubeletVersion"`
 }
 
 // Arguments masks the value so protobuf can generate