From a95c0c5499c54c16d561d0ad4537d4b43d500184 Mon Sep 17 00:00:00 2001
From: Sean Sullivan <seans3@gmail.com>
Date: Sun, 13 Oct 2024 17:50:18 -0700
Subject: [PATCH] Enable strict validation for ResourceQuotaConfiguration

---
 .../admission/plugin/resourcequota/config.go  |  2 +-
 .../plugin/resourcequota/config_test.go       | 28 +++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/staging/src/k8s.io/apiserver/pkg/admission/plugin/resourcequota/config.go b/staging/src/k8s.io/apiserver/pkg/admission/plugin/resourcequota/config.go
index 4d4f8b9c41a..043bcc81fce 100644
--- a/staging/src/k8s.io/apiserver/pkg/admission/plugin/resourcequota/config.go
+++ b/staging/src/k8s.io/apiserver/pkg/admission/plugin/resourcequota/config.go
@@ -29,7 +29,7 @@ import (
 
 var (
 	scheme = runtime.NewScheme()
-	codecs = serializer.NewCodecFactory(scheme)
+	codecs = serializer.NewCodecFactory(scheme, serializer.EnableStrict)
 )
 
 func init() {
diff --git a/staging/src/k8s.io/apiserver/pkg/admission/plugin/resourcequota/config_test.go b/staging/src/k8s.io/apiserver/pkg/admission/plugin/resourcequota/config_test.go
index 1b03c405a2e..3a96a5530ac 100644
--- a/staging/src/k8s.io/apiserver/pkg/admission/plugin/resourcequota/config_test.go
+++ b/staging/src/k8s.io/apiserver/pkg/admission/plugin/resourcequota/config_test.go
@@ -43,6 +43,34 @@ func TestLoadConfiguration(t *testing.T) {
 			input:     `{"kind":"Unknown","apiVersion":"v1"}`,
 			expectErr: `no kind "Unknown" is registered`,
 		},
+		{
+			name: "duplicate field error; strict validation",
+			input: `
+kind: ResourceQuotaConfiguration
+apiVersion: apiserver.config.k8s.io/v1
+limitedResources:
+- apiGroup: ""
+  resource: persistentvolumeclaims
+  resource: persistentvolumeclaims
+  matchContains:
+  - .storageclass.storage.k8s.io/requests.storage
+`,
+			expectErr: `strict decoding error`,
+		},
+		{
+			name: "unknown field error; strict validation",
+			input: `
+kind: ResourceQuotaConfiguration
+apiVersion: apiserver.config.k8s.io/v1
+limitedResources:
+- apiGroup: ""
+  foo:      bar
+  resource: persistentvolumeclaims
+  matchContains:
+  - .storageclass.storage.k8s.io/requests.storage
+`,
+			expectErr: `strict decoding error`,
+		},
 		{
 			name: "valid v1alpha1 config",
 			input: `