apiextension: reject x-kubernetes-embedded-resource with empty properties

staging/src/k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/validation/validation_test.go

@@ -1786,6 +1786,50 @@ func TestValidateCustomResourceDefinition(t *testing.T) {
 				required("spec", "validation", "openAPIV3Schema", "type"),
 			},
 		},
+		{
+			name: "x-kubernetes-embedded-resource with pruning and empty properties",
+			resource: &apiextensions.CustomResourceDefinition{
+				ObjectMeta: metav1.ObjectMeta{Name: "plural.group.com"},
+				Spec: apiextensions.CustomResourceDefinitionSpec{
+					Group:    "group.com",
+					Version:  "version",
+					Versions: singleVersionList,
+					Scope:    apiextensions.NamespaceScoped,
+					Names: apiextensions.CustomResourceDefinitionNames{
+						Plural:   "plural",
+						Singular: "singular",
+						Kind:     "Plural",
+						ListKind: "PluralList",
+					},
+					Validation: &apiextensions.CustomResourceValidation{
+						OpenAPIV3Schema: &apiextensions.JSONSchemaProps{
+							Type: "object",
+							Properties: map[string]apiextensions.JSONSchemaProps{
+								"nil": {
+									Type:              "object",
+									XEmbeddedResource: true,
+									Properties:        nil,
+								},
+								"empty": {
+									Type:              "object",
+									XEmbeddedResource: true,
+									Properties:        map[string]apiextensions.JSONSchemaProps{},
+								},
+							},
+						},
+					},
+					PreserveUnknownFields: pointer.BoolPtr(true),
+				},
+				Status: apiextensions.CustomResourceDefinitionStatus{
+					StoredVersions: []string{"version"},
+				},
+			},
+			requestGV: apiextensionsv1beta1.SchemeGroupVersion,
+			errors: []validationMatch{
+				required("spec", "validation", "openAPIV3Schema", "properties[nil]", "properties"),
+				required("spec", "validation", "openAPIV3Schema", "properties[empty]", "properties"),
+			},
+		},
 		{
 			name: "x-kubernetes-embedded-resource inside resource meta",
 			resource: &apiextensions.CustomResourceDefinition{

staging/src/k8s.io/apiextensions-apiserver/pkg/apiserver/schema/validation.go

@@ -170,7 +170,7 @@ func validateStructuralInvariants(s *Structural, lvl level, fldPath *field.Path)
 		}
 	}
 
-	if s.XEmbeddedResource && !s.XPreserveUnknownFields && s.Properties == nil {
+	if s.XEmbeddedResource && !s.XPreserveUnknownFields && len(s.Properties) == 0 {
 		allErrs = append(allErrs, field.Required(fldPath.Child("properties"), "must not be empty if x-kubernetes-embedded-resource is true without x-kubernetes-preserve-unknown-fields"))
 	}