From 46e9b9e671c9a1e2b894c7305045881bcd7b4950 Mon Sep 17 00:00:00 2001 From: ShaanveerS Date: Tue, 28 Oct 2025 11:27:03 +0100 Subject: [PATCH] feat(kal): enforce optional/required on imagepolicy API group --- hack/golangci-hints.yaml | 2 +- hack/golangci.yaml | 2 +- hack/kube-api-linter/exceptions.yaml | 2 +- pkg/generated/openapi/zz_generated.openapi.go | 2 -- staging/src/k8s.io/api/imagepolicy/v1alpha1/generated.proto | 2 ++ staging/src/k8s.io/api/imagepolicy/v1alpha1/types.go | 2 ++ 6 files changed, 7 insertions(+), 5 deletions(-) diff --git a/hack/golangci-hints.yaml b/hack/golangci-hints.yaml index 94012b124f8..8f58c169af1 100644 --- a/hack/golangci-hints.yaml +++ b/hack/golangci-hints.yaml @@ -214,7 +214,7 @@ linters: # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags. - text: "must be marked as optional or required" - path: "staging/src/k8s.io/api/(admission|apidiscovery|apiserverinternal|apps|authentication|authorization|autoscaling|batch|certificates|coordination|core|discovery|events|extensions|flowcontrol|imagepolicy|networking|node|policy|rbac|resource|storage|storagemigration)" + path: "staging/src/k8s.io/api/(admission|apidiscovery|apiserverinternal|apps|authentication|authorization|autoscaling|batch|certificates|coordination|core|discovery|events|extensions|flowcontrol|networking|node|policy|rbac|resource|storage|storagemigration)" # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed. - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required" diff --git a/hack/golangci.yaml b/hack/golangci.yaml index ea98d9bdff4..66f2bf1e43a 100644 --- a/hack/golangci.yaml +++ b/hack/golangci.yaml @@ -225,7 +225,7 @@ linters: # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags. - text: "must be marked as optional or required" - path: "staging/src/k8s.io/api/(admission|apidiscovery|apiserverinternal|apps|authentication|authorization|autoscaling|batch|certificates|coordination|core|discovery|events|extensions|flowcontrol|imagepolicy|networking|node|policy|rbac|resource|storage|storagemigration)" + path: "staging/src/k8s.io/api/(admission|apidiscovery|apiserverinternal|apps|authentication|authorization|autoscaling|batch|certificates|coordination|core|discovery|events|extensions|flowcontrol|networking|node|policy|rbac|resource|storage|storagemigration)" # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed. - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required" diff --git a/hack/kube-api-linter/exceptions.yaml b/hack/kube-api-linter/exceptions.yaml index 175fe8a31e7..0acd6ecd112 100644 --- a/hack/kube-api-linter/exceptions.yaml +++ b/hack/kube-api-linter/exceptions.yaml @@ -90,7 +90,7 @@ # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags. - text: "must be marked as optional or required" - path: "staging/src/k8s.io/api/(admission|apidiscovery|apiserverinternal|apps|authentication|authorization|autoscaling|batch|certificates|coordination|core|discovery|events|extensions|flowcontrol|imagepolicy|networking|node|policy|rbac|resource|storage|storagemigration)" + path: "staging/src/k8s.io/api/(admission|apidiscovery|apiserverinternal|apps|authentication|authorization|autoscaling|batch|certificates|coordination|core|discovery|events|extensions|flowcontrol|networking|node|policy|rbac|resource|storage|storagemigration)" # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed. - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required" diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go index 995f0339399..9024887b4d1 100644 --- a/pkg/generated/openapi/zz_generated.openapi.go +++ b/pkg/generated/openapi/zz_generated.openapi.go @@ -40490,7 +40490,6 @@ func schema_k8sio_api_imagepolicy_v1alpha1_ImageReview(ref common.ReferenceCallb }, }, }, - Required: []string{"spec"}, }, }, Dependencies: []string{ @@ -40614,7 +40613,6 @@ func schema_k8sio_api_imagepolicy_v1alpha1_ImageReviewStatus(ref common.Referenc }, }, }, - Required: []string{"allowed"}, }, }, } diff --git a/staging/src/k8s.io/api/imagepolicy/v1alpha1/generated.proto b/staging/src/k8s.io/api/imagepolicy/v1alpha1/generated.proto index 5ea5c0ec8e8..03b1ac45c02 100644 --- a/staging/src/k8s.io/api/imagepolicy/v1alpha1/generated.proto +++ b/staging/src/k8s.io/api/imagepolicy/v1alpha1/generated.proto @@ -36,6 +36,7 @@ message ImageReview { optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; // Spec holds information about the pod being evaluated + // +optional optional ImageReviewSpec spec = 2; // Status is filled in by the backend and indicates whether the pod should be allowed. @@ -71,6 +72,7 @@ message ImageReviewSpec { // ImageReviewStatus is the result of the review for the pod creation request. message ImageReviewStatus { // Allowed indicates that all images were allowed to be run. + // +optional optional bool allowed = 1; // Reason should be empty unless Allowed is false in which case it diff --git a/staging/src/k8s.io/api/imagepolicy/v1alpha1/types.go b/staging/src/k8s.io/api/imagepolicy/v1alpha1/types.go index 19ac2b536f9..cc8f4cf89f2 100644 --- a/staging/src/k8s.io/api/imagepolicy/v1alpha1/types.go +++ b/staging/src/k8s.io/api/imagepolicy/v1alpha1/types.go @@ -34,6 +34,7 @@ type ImageReview struct { metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` // Spec holds information about the pod being evaluated + // +optional Spec ImageReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"` // Status is filled in by the backend and indicates whether the pod should be allowed. @@ -68,6 +69,7 @@ type ImageReviewContainerSpec struct { // ImageReviewStatus is the result of the review for the pod creation request. type ImageReviewStatus struct { // Allowed indicates that all images were allowed to be run. + // +optional Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"` // Reason should be empty unless Allowed is false in which case it // may contain a short description of what is wrong. Kubernetes