Split api into api, api/common, api/validation & apitools

pkg/api/validation/validation.go

@@ -0,0 +1,295 @@
+/*
+Copyright 2014 Google Inc. All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"strings"
+
+	errs "github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/labels"
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/util"
+)
+
+func validateVolumes(volumes []Volume) (util.StringSet, errs.ErrorList) {
+	allErrs := errs.ErrorList{}
+
+	allNames := util.StringSet{}
+	for i := range volumes {
+		vol := &volumes[i] // so we can set default values
+		el := errs.ErrorList{}
+		// TODO(thockin) enforce that a source is set once we deprecate the implied form.
+		if vol.Source != nil {
+			el = validateSource(vol.Source).Prefix("source")
+		}
+		if len(vol.Name) == 0 {
+			el = append(el, errs.NewRequired("name", vol.Name))
+		} else if !util.IsDNSLabel(vol.Name) {
+			el = append(el, errs.NewInvalid("name", vol.Name))
+		} else if allNames.Has(vol.Name) {
+			el = append(el, errs.NewDuplicate("name", vol.Name))
+		}
+		if len(el) == 0 {
+			allNames.Insert(vol.Name)
+		} else {
+			allErrs = append(allErrs, el.PrefixIndex(i)...)
+		}
+	}
+	return allNames, allErrs
+}
+
+func validateSource(source *VolumeSource) errs.ErrorList {
+	numVolumes := 0
+	allErrs := errs.ErrorList{}
+	if source.HostDirectory != nil {
+		numVolumes++
+		allErrs = append(allErrs, validateHostDir(source.HostDirectory).Prefix("hostDirectory")...)
+	}
+	if source.EmptyDirectory != nil {
+		numVolumes++
+		//EmptyDirs have nothing to validate
+	}
+	if numVolumes != 1 {
+		allErrs = append(allErrs, errs.NewInvalid("", source))
+	}
+	return allErrs
+}
+
+func validateHostDir(hostDir *HostDirectory) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+	if hostDir.Path == "" {
+		allErrs = append(allErrs, errs.NewNotFound("path", hostDir.Path))
+	}
+	return allErrs
+}
+
+var supportedPortProtocols = util.NewStringSet("TCP", "UDP")
+
+func validatePorts(ports []Port) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+
+	allNames := util.StringSet{}
+	for i := range ports {
+		pErrs := errs.ErrorList{}
+		port := &ports[i] // so we can set default values
+		if len(port.Name) > 0 {
+			if len(port.Name) > 63 || !util.IsDNSLabel(port.Name) {
+				pErrs = append(pErrs, errs.NewInvalid("name", port.Name))
+			} else if allNames.Has(port.Name) {
+				pErrs = append(pErrs, errs.NewDuplicate("name", port.Name))
+			} else {
+				allNames.Insert(port.Name)
+			}
+		}
+		if port.ContainerPort == 0 {
+			pErrs = append(pErrs, errs.NewRequired("containerPort", port.ContainerPort))
+		} else if !util.IsValidPortNum(port.ContainerPort) {
+			pErrs = append(pErrs, errs.NewInvalid("containerPort", port.ContainerPort))
+		}
+		if port.HostPort != 0 && !util.IsValidPortNum(port.HostPort) {
+			pErrs = append(pErrs, errs.NewInvalid("hostPort", port.HostPort))
+		}
+		if len(port.Protocol) == 0 {
+			port.Protocol = "TCP"
+		} else if !supportedPortProtocols.Has(strings.ToUpper(port.Protocol)) {
+			pErrs = append(pErrs, errs.NewNotSupported("protocol", port.Protocol))
+		}
+		allErrs = append(allErrs, pErrs.PrefixIndex(i)...)
+	}
+	return allErrs
+}
+
+func validateEnv(vars []EnvVar) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+
+	for i := range vars {
+		vErrs := errs.ErrorList{}
+		ev := &vars[i] // so we can set default values
+		if len(ev.Name) == 0 {
+			vErrs = append(vErrs, errs.NewRequired("name", ev.Name))
+		}
+		if !util.IsCIdentifier(ev.Name) {
+			vErrs = append(vErrs, errs.NewInvalid("name", ev.Name))
+		}
+		allErrs = append(allErrs, vErrs.PrefixIndex(i)...)
+	}
+	return allErrs
+}
+
+func validateVolumeMounts(mounts []VolumeMount, volumes util.StringSet) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+
+	for i := range mounts {
+		mErrs := errs.ErrorList{}
+		mnt := &mounts[i] // so we can set default values
+		if len(mnt.Name) == 0 {
+			mErrs = append(mErrs, errs.NewRequired("name", mnt.Name))
+		} else if !volumes.Has(mnt.Name) {
+			mErrs = append(mErrs, errs.NewNotFound("name", mnt.Name))
+		}
+		if len(mnt.MountPath) == 0 {
+			mErrs = append(mErrs, errs.NewRequired("mountPath", mnt.MountPath))
+		}
+		allErrs = append(allErrs, mErrs.PrefixIndex(i)...)
+	}
+	return allErrs
+}
+
+// AccumulateUniquePorts runs an extraction function on each Port of each Container,
+// accumulating the results and returning an error if any ports conflict.
+func AccumulateUniquePorts(containers []Container, accumulator map[int]bool, extract func(*Port) int) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+
+	for ci := range containers {
+		cErrs := errs.ErrorList{}
+		ctr := &containers[ci]
+		for pi := range ctr.Ports {
+			port := extract(&ctr.Ports[pi])
+			if port == 0 {
+				continue
+			}
+			if accumulator[port] {
+				cErrs = append(cErrs, errs.NewDuplicate("Port", port))
+			} else {
+				accumulator[port] = true
+			}
+		}
+		allErrs = append(allErrs, cErrs.PrefixIndex(ci)...)
+	}
+	return allErrs
+}
+
+// checkHostPortConflicts checks for colliding Port.HostPort values across
+// a slice of containers.
+func checkHostPortConflicts(containers []Container) errs.ErrorList {
+	allPorts := map[int]bool{}
+	return AccumulateUniquePorts(containers, allPorts, func(p *Port) int { return p.HostPort })
+}
+
+func validateContainers(containers []Container, volumes util.StringSet) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+
+	allNames := util.StringSet{}
+	for i := range containers {
+		cErrs := errs.ErrorList{}
+		ctr := &containers[i] // so we can set default values
+		if len(ctr.Name) == 0 {
+			cErrs = append(cErrs, errs.NewRequired("name", ctr.Name))
+		} else if !util.IsDNSLabel(ctr.Name) {
+			cErrs = append(cErrs, errs.NewInvalid("name", ctr.Name))
+		} else if allNames.Has(ctr.Name) {
+			cErrs = append(cErrs, errs.NewDuplicate("name", ctr.Name))
+		} else {
+			allNames.Insert(ctr.Name)
+		}
+		if len(ctr.Image) == 0 {
+			cErrs = append(cErrs, errs.NewRequired("image", ctr.Image))
+		}
+		cErrs = append(cErrs, validatePorts(ctr.Ports).Prefix("ports")...)
+		cErrs = append(cErrs, validateEnv(ctr.Env).Prefix("env")...)
+		cErrs = append(cErrs, validateVolumeMounts(ctr.VolumeMounts, volumes).Prefix("volumeMounts")...)
+		allErrs = append(allErrs, cErrs.PrefixIndex(i)...)
+	}
+	// Check for colliding ports across all containers.
+	// TODO(thockin): This really is dependent on the network config of the host (IP per pod?)
+	// and the config of the new manifest.  But we have not specced that out yet, so we'll just
+	// make some assumptions for now.  As of now, pods share a network namespace, which means that
+	// every Port.HostPort across the whole pod must be unique.
+	allErrs = append(allErrs, checkHostPortConflicts(containers)...)
+
+	return allErrs
+}
+
+var supportedManifestVersions = util.NewStringSet("v1beta1", "v1beta2")
+
+// ValidateManifest tests that the specified ContainerManifest has valid data.
+// This includes checking formatting and uniqueness.  It also canonicalizes the
+// structure by setting default values and implementing any backwards-compatibility
+// tricks.
+func ValidateManifest(manifest *ContainerManifest) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+
+	if len(manifest.Version) == 0 {
+		allErrs = append(allErrs, errs.NewRequired("version", manifest.Version))
+	} else if !supportedManifestVersions.Has(strings.ToLower(manifest.Version)) {
+		allErrs = append(allErrs, errs.NewNotSupported("version", manifest.Version))
+	}
+	allVolumes, errs := validateVolumes(manifest.Volumes)
+	allErrs = append(allErrs, errs.Prefix("volumes")...)
+	allErrs = append(allErrs, validateContainers(manifest.Containers, allVolumes).Prefix("containers")...)
+	return allErrs
+}
+
+func ValidatePodState(podState *PodState) errs.ErrorList {
+	allErrs := errs.ErrorList(ValidateManifest(&podState.Manifest)).Prefix("manifest")
+	if podState.RestartPolicy.Type == "" {
+		podState.RestartPolicy.Type = RestartAlways
+	} else if podState.RestartPolicy.Type != RestartAlways &&
+		podState.RestartPolicy.Type != RestartOnFailure &&
+		podState.RestartPolicy.Type != RestartNever {
+		allErrs = append(allErrs, errs.NewNotSupported("restartPolicy.type", podState.RestartPolicy.Type))
+	}
+
+	return allErrs
+}
+
+// ValidatePod tests if required fields in the pod are set.
+func ValidatePod(pod *Pod) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+	if len(pod.ID) == 0 {
+		allErrs = append(allErrs, errs.NewRequired("id", pod.ID))
+	}
+	allErrs = append(allErrs, ValidatePodState(&pod.DesiredState).Prefix("desiredState")...)
+	return allErrs
+}
+
+// ValidateService tests if required fields in the service are set.
+func ValidateService(service *Service) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+	if len(service.ID) == 0 {
+		allErrs = append(allErrs, errs.NewRequired("id", service.ID))
+	} else if !util.IsDNS952Label(service.ID) {
+		allErrs = append(allErrs, errs.NewInvalid("id", service.ID))
+	}
+	if !util.IsValidPortNum(service.Port) {
+		allErrs = append(allErrs, errs.NewInvalid("Service.Port", service.Port))
+	}
+	if labels.Set(service.Selector).AsSelector().Empty() {
+		allErrs = append(allErrs, errs.NewRequired("selector", service.Selector))
+	}
+	return allErrs
+}
+
+// ValidateReplicationController tests if required fields in the replication controller are set.
+func ValidateReplicationController(controller *ReplicationController) errs.ErrorList {
+	allErrs := errs.ErrorList{}
+	if len(controller.ID) == 0 {
+		allErrs = append(allErrs, errs.NewRequired("id", controller.ID))
+	}
+	if labels.Set(controller.DesiredState.ReplicaSelector).AsSelector().Empty() {
+		allErrs = append(allErrs, errs.NewRequired("desiredState.replicaSelector", controller.DesiredState.ReplicaSelector))
+	}
+	selector := labels.Set(controller.DesiredState.ReplicaSelector).AsSelector()
+	labels := labels.Set(controller.DesiredState.PodTemplate.Labels)
+	if !selector.Matches(labels) {
+		allErrs = append(allErrs, errs.NewInvalid("desiredState.podTemplate.labels", controller.DesiredState.PodTemplate))
+	}
+	if controller.DesiredState.Replicas < 0 {
+		allErrs = append(allErrs, errs.NewInvalid("desiredState.replicas", controller.DesiredState.Replicas))
+	}
+	allErrs = append(allErrs, ValidateManifest(&controller.DesiredState.PodTemplate.DesiredState.Manifest).Prefix("desiredState.podTemplate.desiredState.manifest")...)
+	return allErrs
+}

pkg/api/validation/validation_test.go

@@ -0,0 +1,454 @@
+/*
+Copyright 2014 Google Inc. All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/util"
+)
+
+func expectPrefix(t *testing.T, prefix string, errs errors.ErrorList) {
+	for i := range errs {
+		if !strings.HasPrefix(errs[i].(errors.ValidationError).Field, prefix) {
+			t.Errorf("expected prefix '%s' for %v", errs[i])
+		}
+	}
+}
+
+func TestValidateVolumes(t *testing.T) {
+	successCase := []Volume{
+		{Name: "abc"},
+		{Name: "123", Source: &VolumeSource{HostDirectory: &HostDirectory{"/mnt/path2"}}},
+		{Name: "abc-123", Source: &VolumeSource{HostDirectory: &HostDirectory{"/mnt/path3"}}},
+		{Name: "empty", Source: &VolumeSource{EmptyDirectory: &EmptyDirectory{}}},
+	}
+	names, errs := validateVolumes(successCase)
+	if len(errs) != 0 {
+		t.Errorf("expected success: %v", errs)
+	}
+	if len(names) != 4 || !names.HasAll("abc", "123", "abc-123", "empty") {
+		t.Errorf("wrong names result: %v", names)
+	}
+
+	errorCases := map[string]struct {
+		V []Volume
+		T errors.ValidationErrorType
+		F string
+	}{
+		"zero-length name":     {[]Volume{{Name: ""}}, errors.ValidationErrorTypeRequired, "[0].name"},
+		"name > 63 characters": {[]Volume{{Name: strings.Repeat("a", 64)}}, errors.ValidationErrorTypeInvalid, "[0].name"},
+		"name not a DNS label": {[]Volume{{Name: "a.b.c"}}, errors.ValidationErrorTypeInvalid, "[0].name"},
+		"name not unique":      {[]Volume{{Name: "abc"}, {Name: "abc"}}, errors.ValidationErrorTypeDuplicate, "[1].name"},
+	}
+	for k, v := range errorCases {
+		_, errs := validateVolumes(v.V)
+		if len(errs) == 0 {
+			t.Errorf("expected failure for %s", k)
+			continue
+		}
+		for i := range errs {
+			if errs[i].(errors.ValidationError).Type != v.T {
+				t.Errorf("%s: expected errors to have type %s: %v", k, v.T, errs[i])
+			}
+			if errs[i].(errors.ValidationError).Field != v.F {
+				t.Errorf("%s: expected errors to have field %s: %v", k, v.F, errs[i])
+			}
+		}
+	}
+}
+
+func TestValidatePorts(t *testing.T) {
+	successCase := []Port{
+		{Name: "abc", ContainerPort: 80, HostPort: 80, Protocol: "TCP"},
+		{Name: "123", ContainerPort: 81, HostPort: 81},
+		{Name: "easy", ContainerPort: 82, Protocol: "TCP"},
+		{Name: "as", ContainerPort: 83, Protocol: "UDP"},
+		{Name: "do-re-me", ContainerPort: 84},
+		{Name: "baby-you-and-me", ContainerPort: 82, Protocol: "tcp"},
+		{ContainerPort: 85},
+	}
+	if errs := validatePorts(successCase); len(errs) != 0 {
+		t.Errorf("expected success: %v", errs)
+	}
+
+	nonCanonicalCase := []Port{
+		{ContainerPort: 80},
+	}
+	if errs := validatePorts(nonCanonicalCase); len(errs) != 0 {
+		t.Errorf("expected success: %v", errs)
+	}
+	if nonCanonicalCase[0].HostPort != 0 || nonCanonicalCase[0].Protocol != "TCP" {
+		t.Errorf("expected default values: %+v", nonCanonicalCase[0])
+	}
+
+	errorCases := map[string]struct {
+		P []Port
+		T errors.ValidationErrorType
+		F string
+	}{
+		"name > 63 characters": {[]Port{{Name: strings.Repeat("a", 64), ContainerPort: 80}}, errors.ValidationErrorTypeInvalid, "[0].name"},
+		"name not a DNS label": {[]Port{{Name: "a.b.c", ContainerPort: 80}}, errors.ValidationErrorTypeInvalid, "[0].name"},
+		"name not unique": {[]Port{
+			{Name: "abc", ContainerPort: 80},
+			{Name: "abc", ContainerPort: 81},
+		}, errors.ValidationErrorTypeDuplicate, "[1].name"},
+		"zero container port":    {[]Port{{ContainerPort: 0}}, errors.ValidationErrorTypeRequired, "[0].containerPort"},
+		"invalid container port": {[]Port{{ContainerPort: 65536}}, errors.ValidationErrorTypeInvalid, "[0].containerPort"},
+		"invalid host port":      {[]Port{{ContainerPort: 80, HostPort: 65536}}, errors.ValidationErrorTypeInvalid, "[0].hostPort"},
+		"invalid protocol":       {[]Port{{ContainerPort: 80, Protocol: "ICMP"}}, errors.ValidationErrorTypeNotSupported, "[0].protocol"},
+	}
+	for k, v := range errorCases {
+		errs := validatePorts(v.P)
+		if len(errs) == 0 {
+			t.Errorf("expected failure for %s", k)
+		}
+		for i := range errs {
+			if errs[i].(errors.ValidationError).Type != v.T {
+				t.Errorf("%s: expected errors to have type %s: %v", k, v.T, errs[i])
+			}
+			if errs[i].(errors.ValidationError).Field != v.F {
+				t.Errorf("%s: expected errors to have field %s: %v", k, v.F, errs[i])
+			}
+		}
+	}
+}
+
+func TestValidateEnv(t *testing.T) {
+	successCase := []EnvVar{
+		{Name: "abc", Value: "value"},
+		{Name: "ABC", Value: "value"},
+		{Name: "AbC_123", Value: "value"},
+		{Name: "abc", Value: ""},
+	}
+	if errs := validateEnv(successCase); len(errs) != 0 {
+		t.Errorf("expected success: %v", errs)
+	}
+
+	errorCases := map[string][]EnvVar{
+		"zero-length name":        {{Name: ""}},
+		"name not a C identifier": {{Name: "a.b.c"}},
+	}
+	for k, v := range errorCases {
+		if errs := validateEnv(v); len(errs) == 0 {
+			t.Errorf("expected failure for %s", k)
+		}
+	}
+}
+
+func TestValidateVolumeMounts(t *testing.T) {
+	volumes := util.NewStringSet("abc", "123", "abc-123")
+
+	successCase := []VolumeMount{
+		{Name: "abc", MountPath: "/foo"},
+		{Name: "123", MountPath: "/foo"},
+		{Name: "abc-123", MountPath: "/bar"},
+	}
+	if errs := validateVolumeMounts(successCase, volumes); len(errs) != 0 {
+		t.Errorf("expected success: %v", errs)
+	}
+
+	errorCases := map[string][]VolumeMount{
+		"empty name":      {{Name: "", MountPath: "/foo"}},
+		"name not found":  {{Name: "", MountPath: "/foo"}},
+		"empty mountpath": {{Name: "abc", MountPath: ""}},
+	}
+	for k, v := range errorCases {
+		if errs := validateVolumeMounts(v, volumes); len(errs) == 0 {
+			t.Errorf("expected failure for %s", k)
+		}
+	}
+}
+
+func TestValidateContainers(t *testing.T) {
+	volumes := util.StringSet{}
+
+	successCase := []Container{
+		{Name: "abc", Image: "image"},
+		{Name: "123", Image: "image"},
+		{Name: "abc-123", Image: "image"},
+	}
+	if errs := validateContainers(successCase, volumes); len(errs) != 0 {
+		t.Errorf("expected success: %v", errs)
+	}
+
+	errorCases := map[string][]Container{
+		"zero-length name":     {{Name: "", Image: "image"}},
+		"name > 63 characters": {{Name: strings.Repeat("a", 64), Image: "image"}},
+		"name not a DNS label": {{Name: "a.b.c", Image: "image"}},
+		"name not unique": {
+			{Name: "abc", Image: "image"},
+			{Name: "abc", Image: "image"},
+		},
+		"zero-length image": {{Name: "abc", Image: ""}},
+		"host port not unique": {
+			{Name: "abc", Image: "image", Ports: []Port{{ContainerPort: 80, HostPort: 80}}},
+			{Name: "def", Image: "image", Ports: []Port{{ContainerPort: 81, HostPort: 80}}},
+		},
+		"invalid env var name": {
+			{Name: "abc", Image: "image", Env: []EnvVar{{Name: "ev.1"}}},
+		},
+		"unknown volume name": {
+			{Name: "abc", Image: "image", VolumeMounts: []VolumeMount{{Name: "anything", MountPath: "/foo"}}},
+		},
+	}
+	for k, v := range errorCases {
+		if errs := validateContainers(v, volumes); len(errs) == 0 {
+			t.Errorf("expected failure for %s", k)
+		}
+	}
+}
+
+func TestValidateManifest(t *testing.T) {
+	successCases := []ContainerManifest{
+		{Version: "v1beta1", ID: "abc"},
+		{Version: "v1beta2", ID: "123"},
+		{Version: "V1BETA1", ID: "abc.123.do-re-mi"},
+		{
+			Version: "v1beta1",
+			ID:      "abc",
+			Volumes: []Volume{{Name: "vol1", Source: &VolumeSource{HostDirectory: &HostDirectory{"/mnt/vol1"}}},
+				{Name: "vol2", Source: &VolumeSource{HostDirectory: &HostDirectory{"/mnt/vol2"}}}},
+			Containers: []Container{
+				{
+					Name:       "abc",
+					Image:      "image",
+					Command:    []string{"foo", "bar"},
+					WorkingDir: "/tmp",
+					Memory:     1,
+					CPU:        1,
+					Ports: []Port{
+						{Name: "p1", ContainerPort: 80, HostPort: 8080},
+						{Name: "p2", ContainerPort: 81},
+						{ContainerPort: 82},
+					},
+					Env: []EnvVar{
+						{Name: "ev1", Value: "val1"},
+						{Name: "ev2", Value: "val2"},
+						{Name: "EV3", Value: "val3"},
+					},
+					VolumeMounts: []VolumeMount{
+						{Name: "vol1", MountPath: "/foo"},
+						{Name: "vol1", MountPath: "/bar"},
+					},
+				},
+			},
+		},
+	}
+	for _, manifest := range successCases {
+		if errs := ValidateManifest(&manifest); len(errs) != 0 {
+			t.Errorf("expected success: %v", errs)
+		}
+	}
+
+	errorCases := map[string]ContainerManifest{
+		"empty version":   {Version: "", ID: "abc"},
+		"invalid version": {Version: "bogus", ID: "abc"},
+		"invalid volume name": {
+			Version: "v1beta1",
+			ID:      "abc",
+			Volumes: []Volume{{Name: "vol.1"}},
+		},
+		"invalid container name": {
+			Version:    "v1beta1",
+			ID:         "abc",
+			Containers: []Container{{Name: "ctr.1", Image: "image"}},
+		},
+	}
+	for k, v := range errorCases {
+		if errs := ValidateManifest(&v); len(errs) == 0 {
+			t.Errorf("expected failure for %s", k)
+		}
+	}
+}
+
+func TestValidatePod(t *testing.T) {
+	errs := ValidatePod(&Pod{
+		JSONBase: JSONBase{ID: "foo"},
+		Labels: map[string]string{
+			"foo": "bar",
+		},
+		DesiredState: PodState{
+			Manifest:      ContainerManifest{Version: "v1beta1", ID: "abc"},
+			RestartPolicy: RestartPolicy{Type: "RestartAlways"},
+		},
+	})
+	if len(errs) != 0 {
+		t.Errorf("Unexpected non-zero error list: %#v", errs)
+	}
+	errs = ValidatePod(&Pod{
+		JSONBase: JSONBase{ID: "foo"},
+		Labels: map[string]string{
+			"foo": "bar",
+		},
+		DesiredState: PodState{
+			Manifest: ContainerManifest{Version: "v1beta1", ID: "abc"},
+		},
+	})
+	if len(errs) != 0 {
+		t.Errorf("Unexpected non-zero error list: %#v", errs)
+	}
+
+	errs = ValidatePod(&Pod{
+		JSONBase: JSONBase{ID: "foo"},
+		Labels: map[string]string{
+			"foo": "bar",
+		},
+		DesiredState: PodState{
+			Manifest:      ContainerManifest{Version: "v1beta1", ID: "abc"},
+			RestartPolicy: RestartPolicy{Type: "WhatEver"},
+		},
+	})
+	if len(errs) != 1 {
+		t.Errorf("Unexpected error list: %#v", errs)
+	}
+}
+
+func TestValidateService(t *testing.T) {
+	// This test should fail because the port number is invalid i.e.
+	// the Port field has a default value of 0.
+	errs := ValidateService(&Service{
+		JSONBase: JSONBase{ID: "foo"},
+		Selector: map[string]string{
+			"foo": "bar",
+		},
+	})
+	if len(errs) != 1 {
+		t.Errorf("Unexpected error list: %#v", errs)
+	}
+
+	errs = ValidateService(&Service{
+		Port:     6502,
+		JSONBase: JSONBase{ID: "foo"},
+		Selector: map[string]string{
+			"foo": "bar",
+		},
+	})
+	if len(errs) != 0 {
+		t.Errorf("Unexpected non-zero error list: %#v", errs)
+	}
+
+	errs = ValidateService(&Service{
+		Port: 6502,
+		Selector: map[string]string{
+			"foo": "bar",
+		},
+	})
+	if len(errs) != 1 {
+		t.Errorf("Unexpected error list: %#v", errs)
+	}
+
+	errs = ValidateService(&Service{
+		Port:     6502,
+		JSONBase: JSONBase{ID: "foo"},
+	})
+	if len(errs) != 1 {
+		t.Errorf("Unexpected error list: %#v", errs)
+	}
+
+	errs = ValidateService(&Service{})
+	if len(errs) != 3 {
+		t.Errorf("Unexpected error list: %#v", errs)
+	}
+}
+
+func TestValidateReplicationController(t *testing.T) {
+	validSelector := map[string]string{"a": "b"}
+	validPodTemplate := PodTemplate{
+		DesiredState: PodState{
+			Manifest: ContainerManifest{
+				Version: "v1beta1",
+			},
+		},
+		Labels: validSelector,
+	}
+
+	successCases := []ReplicationController{
+		{
+			JSONBase: JSONBase{ID: "abc"},
+			DesiredState: ReplicationControllerState{
+				ReplicaSelector: validSelector,
+				PodTemplate:     validPodTemplate,
+			},
+		},
+		{
+			JSONBase: JSONBase{ID: "abc-123"},
+			DesiredState: ReplicationControllerState{
+				ReplicaSelector: validSelector,
+				PodTemplate:     validPodTemplate,
+			},
+		},
+	}
+	for _, successCase := range successCases {
+		if errs := ValidateReplicationController(&successCase); len(errs) != 0 {
+			t.Errorf("expected success: %v", errs)
+		}
+	}
+
+	errorCases := map[string]ReplicationController{
+		"zero-length ID": {
+			JSONBase: JSONBase{ID: ""},
+			DesiredState: ReplicationControllerState{
+				ReplicaSelector: validSelector,
+				PodTemplate:     validPodTemplate,
+			},
+		},
+		"empty selector": {
+			JSONBase: JSONBase{ID: "abc"},
+			DesiredState: ReplicationControllerState{
+				PodTemplate: validPodTemplate,
+			},
+		},
+		"selector_doesnt_match": {
+			JSONBase: JSONBase{ID: "abc"},
+			DesiredState: ReplicationControllerState{
+				ReplicaSelector: map[string]string{"foo": "bar"},
+				PodTemplate:     validPodTemplate,
+			},
+		},
+		"invalid manifest": {
+			JSONBase: JSONBase{ID: "abc"},
+			DesiredState: ReplicationControllerState{
+				ReplicaSelector: validSelector,
+			},
+		},
+		"negative_replicas": {
+			JSONBase: JSONBase{ID: "abc"},
+			DesiredState: ReplicationControllerState{
+				Replicas:        -1,
+				ReplicaSelector: validSelector,
+			},
+		},
+	}
+	for k, v := range errorCases {
+		errs := ValidateReplicationController(&v)
+		if len(errs) == 0 {
+			t.Errorf("expected failure for %s", k)
+		}
+		for i := range errs {
+			field := errs[i].(errors.ValidationError).Field
+			if !strings.HasPrefix(field, "desiredState.podTemplate.") &&
+				field != "id" &&
+				field != "desiredState.replicaSelector" &&
+				field != "desiredState.replicas" {
+				t.Errorf("%s: missing prefix for: %v", k, errs[i])
+			}
+		}
+	}
+}