kubernetes-sigs/kubectl-validate

Namespace scoping of CRDs is inferred

alexzielenski opened this issue · 9 comments

alexzielenski commented

Currently we have no way to tell from an OpenAPI schema if a CRD is namespace or cluster scoped, so we infer the scope from the presence of the metadata.namespace field. It'd be nice if users could get errors about namespace misuse.

For schemas sourced from local CRDs we have access to this information but do not use it. A small improvement could be to propagate that information, but that would not solve the issue for schemas sourced from OpenAPI/clusters.

apelisse commented

@natasha41575 @mortent I think some people have been complaining about the same thing, i.e. there's no way to know from openapi if a type is namespaced or not. Any idea how we can fix this long-term?

alexzielenski commented

As a dirty hack I think it might be able to be inferred from OpenAPI spec Paths list. If /apis/<group>/<version>/namespaces/{namespace}/<resource> is listed, then the resource is namespace scoped.

apelisse commented

Yes, I think that's the best we've had so far.

mortent commented

This approach was added to Kustomize several years ago: kubernetes-sigs/kustomize#2978.

  • 👍1
alexzielenski commented

Sorry @lauchokyip, #38 was already opened by the time you had replied. I think this issue is fixed now

lauchokyip commented

Thanks @alexzielenski , took a peek at the PR, seem like it was closed to what I wanted to do, just missing some pieces. 👍🏻

eddycharly commented

/close

k8s-ci-robot commented

@eddycharly: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.