Add comprehensive webhook validations for CRD configuration (#1762)

* Add validation webhook for appRepo fields

- Add appsRepoPollInterval validation:
  - Default: 0 (disabled)
  - Minimum: 0, Maximum: 86400 (1 day)
  - Values between 1-59 are rejected (must be 0 or >= 60)

- Add appSources uniqueness validation:
  - Location + Scope combination must be unique across appSources
  - Uses defaults.scope when scope is not specified in appSource
  - volumeName is NOT part of uniqueness check

- Add unit tests for all new validations

* Add premiumAppsProps validation for appSources

- Validate that premiumAppsProps.type is required when scope is 'premiumApps'
- Check both source-level and defaults-level premiumAppsProps.type
- Add unit tests for premiumAppsProps validation scenarios

* Add extraEnv uniqueness validation

- Validate that environment variable names in spec.extraEnv are unique
- Report duplicate names with reference to the first occurrence
- Add unit tests for extraEnv uniqueness validation

* Add imagePullSecrets uniqueness validation

- Validate that secret names in spec.imagePullSecrets are unique
- Report duplicate names with reference to the first occurrence
- Add unit tests for imagePullSecrets uniqueness validation

* Add probe fields validation

- Validate livenessProbe, readinessProbe, and startupProbe configurations
- initialDelaySeconds: minimum 0
- timeoutSeconds: minimum 1
- periodSeconds: minimum 1
- failureThreshold: minimum 1
- Add unit tests for probe validation scenarios

* Add resource requirements validation

- Validate that memory request does not exceed memory limit
- Validate that cpu request does not exceed cpu limit
- Add unit tests for resource requirements validation

* Add SmartStore validation for volumes and indexes

- Validate that indexes require at least one volume to be configured
- Validate that index volumeName references an existing volume in volumes list
- Validate that index has volumeName or defaults.volumeName provided
- Update and add unit tests for SmartStore validation

* Add StorageClassSpec ephemeralStorage mutual exclusivity validation

- Validate that ephemeralStorage is mutually exclusive with storageClassName
- Validate that ephemeralStorage is mutually exclusive with storageCapacity
- Add unit tests for ephemeralStorage mutual exclusivity scenarios

* feat(validation): add imagePullSecrets existence validation

- Add ValidationContext to carry Kubernetes client for resource lookups
- Extend Validator interface with context-aware validation methods
- Implement ValidateImagePullSecretsExistence to verify secrets exist
- Update all CRD validators with context-aware validation functions
- Pass manager client to webhook server for API access
- Update ValidationWebhook.md documentation with new validation rules
- Add unit tests for imagePullSecrets existence validation

This enables the webhook to reject CRs that reference non-existent
secrets in spec.imagePullSecrets, providing early feedback to users.

---------

Co-authored-by: Patryk Wasielewski <pwasiele@splunk.com>

Author: patrykw-splunk

cmd/main.go

@@ -303,6 +303,7 @@ func main() {
 			Validators:   validation.DefaultValidators,
 			ReadTimeout:  readTimeout,
 			WriteTimeout: writeTimeout,
+			Client:       mgr.GetClient(),
 		})
 
 		// Add webhook server as a runnable to the manager

docs/ValidationWebhook.md

@@ -83,6 +83,16 @@ The webhook validates the following spec fields:
 | `spec.varVolumeStorageConfig.storageCapacity` | Must match format `^[0-9]+Gi$` | must be in Gi format (e.g., '10Gi', '100Gi') |
 | `spec.etcVolumeStorageConfig.storageClassName` | Required when `ephemeralStorage=false` and `storageCapacity` is set | storageClassName is required when using persistent storage |
 | `spec.varVolumeStorageConfig.storageClassName` | Required when `ephemeralStorage=false` and `storageCapacity` is set | storageClassName is required when using persistent storage |
+| `spec.etcVolumeStorageConfig.ephemeralStorage` | Mutually exclusive with `storageClassName` and `storageCapacity` | storageClassName/storageCapacity cannot be set when ephemeralStorage is true |
+| `spec.varVolumeStorageConfig.ephemeralStorage` | Mutually exclusive with `storageClassName` and `storageCapacity` | storageClassName/storageCapacity cannot be set when ephemeralStorage is true |
+| `spec.extraEnv[*].name` | Must be unique across all entries | duplicate environment variable |
+| `spec.imagePullSecrets[*].name` | Must be unique across all entries | duplicate secret reference |
+| `spec.imagePullSecrets[*].name` | Must reference an existing Secret in the namespace | not found |
+| `spec.livenessProbe.initialDelaySeconds` | Must be ≥ 0 | must be non-negative |
+| `spec.readinessProbe.initialDelaySeconds` | Must be ≥ 0 | must be non-negative |
+| `spec.startupProbe.initialDelaySeconds` | Must be ≥ 0 | must be non-negative |
+| `spec.resources.requests.cpu` | Must be ≤ `limits.cpu` | request must be less than or equal to limit |
+| `spec.resources.requests.memory` | Must be ≤ `limits.memory` | request must be less than or equal to limit |
 
 ### CRD-Specific Fields
 
@@ -111,6 +121,9 @@ AppFramework configuration is validated only when provided:
 |-------|-----------------|
 | `spec.appRepo.appSources[*].name` | Required (non-empty) |
 | `spec.appRepo.appSources[*].location` | Required (non-empty) |
+| `spec.appRepo.appSources[*]` | Combination of `location` + `scope` must be unique across all appSources |
+| `spec.appRepo.appSources[*].premiumAppsProps` | Required when `scope=premiumApps` |
+| `spec.appRepo.appsRepoPollIntervalSeconds` | Must be ≥ 0 |
 | `spec.appRepo.volumes[*].name` | Required (non-empty) |
 
 ## Example Validation Errors
@@ -167,6 +180,42 @@ Error:
 The Standalone "example" is invalid: spec.smartstore.volumes[0].name: Required value: volume name is required
 ```
 
+### Non-Existent ImagePullSecret
+
+```yaml
+apiVersion: enterprise.splunk.com/v4
+kind: Standalone
+metadata:
+  name: example
+  namespace: splunk
+spec:
+  imagePullSecrets:
+    - name: my-registry-secret  # Invalid: secret does not exist in namespace
+```
+
+Error:
+```
+The Standalone "example" is invalid: spec.imagePullSecrets[0].name: Not found: "my-registry-secret"
+```
+
+### Ephemeral Storage with StorageClassName
+
+```yaml
+apiVersion: enterprise.splunk.com/v4
+kind: Standalone
+metadata:
+  name: example
+spec:
+  etcVolumeStorageConfig:
+    ephemeralStorage: true
+    storageClassName: "standard"  # Invalid: cannot set with ephemeralStorage=true
+```
+
+Error:
+```
+The Standalone "example" is invalid: spec.etcVolumeStorageConfig.storageClassName: Invalid value: "standard": storageClassName cannot be set when ephemeralStorage is true
+```
+
 ## Verifying Webhook Deployment
 
 ### Check Webhook Pod is Running
@@ -264,6 +313,121 @@ The validation webhook consists of:
 5. Webhook returns Allowed/Denied response
 6. If allowed, the resource is persisted; if denied, user receives error
 
+## Adding a New CRD to the Webhook
+
+To add validation for a new CRD, follow these steps:
+
+### 1. Create Validation Functions
+
+Create a new file `pkg/splunk/enterprise/validation/<crd>_validation.go`:
+
+```go
+package validation
+
+import (
+    "k8s.io/apimachinery/pkg/util/validation/field"
+    enterpriseApi "github.com/splunk/splunk-operator/api/v4"
+)
+
+// Validate<CRD>Create validates a <CRD> on CREATE
+func Validate<CRD>Create(obj *enterpriseApi.<CRD>) field.ErrorList {
+    var allErrs field.ErrorList
+    // Add validation logic
+    allErrs = append(allErrs, validateCommonSplunkSpec(&obj.Spec.CommonSplunkSpec, field.NewPath("spec"))...)
+    return allErrs
+}
+
+// Validate<CRD>CreateWithContext validates with access to Kubernetes API
+// Use this for validations that need to check if resources exist (e.g., Secrets)
+func Validate<CRD>CreateWithContext(obj *enterpriseApi.<CRD>, vc *ValidationContext) field.ErrorList {
+    allErrs := Validate<CRD>Create(obj)
+    if len(obj.Spec.ImagePullSecrets) > 0 {
+        allErrs = append(allErrs, ValidateImagePullSecretsExistence(
+            obj.Spec.ImagePullSecrets, vc, field.NewPath("spec").Child("imagePullSecrets"))...)
+    }
+    return allErrs
+}
+
+// Validate<CRD>Update validates a <CRD> on UPDATE
+func Validate<CRD>Update(obj, oldObj *enterpriseApi.<CRD>) field.ErrorList {
+    return Validate<CRD>Create(obj)
+}
+
+// Validate<CRD>UpdateWithContext validates on UPDATE with Kubernetes API access
+func Validate<CRD>UpdateWithContext(obj, oldObj *enterpriseApi.<CRD>, vc *ValidationContext) field.ErrorList {
+    return Validate<CRD>CreateWithContext(obj, vc)
+}
+
+// Get<CRD>WarningsOnCreate returns warnings for CREATE
+func Get<CRD>WarningsOnCreate(obj *enterpriseApi.<CRD>) []string {
+    return getCommonWarnings(&obj.Spec.CommonSplunkSpec)
+}
+
+// Get<CRD>WarningsOnUpdate returns warnings for UPDATE
+func Get<CRD>WarningsOnUpdate(obj, oldObj *enterpriseApi.<CRD>) []string {
+    return Get<CRD>WarningsOnCreate(obj)
+}
+```
+
+### 2. Register the Validator
+
+Add the GVR and validator to `pkg/splunk/enterprise/validation/registry.go`:
+
+```go
+// Add GVR constant
+var <CRD>GVR = schema.GroupVersionResource{
+    Group:    "enterprise.splunk.com",
+    Version:  "v4",
+    Resource: "<crd>s",  // plural, lowercase
+}
+
+// Add to DefaultValidators map
+var DefaultValidators = map[schema.GroupVersionResource]Validator{
+    // ... existing validators ...
+    
+    <CRD>GVR: &GenericValidator[*enterpriseApi.<CRD>]{
+        ValidateCreateFunc:            Validate<CRD>Create,
+        ValidateUpdateFunc:            Validate<CRD>Update,
+        ValidateCreateWithContextFunc: Validate<CRD>CreateWithContext,  // Optional: for resource lookups
+        ValidateUpdateWithContextFunc: Validate<CRD>UpdateWithContext,  // Optional: for resource lookups
+        WarningsOnCreateFunc:          Get<CRD>WarningsOnCreate,
+        WarningsOnUpdateFunc:          Get<CRD>WarningsOnUpdate,
+        GroupKind: schema.GroupKind{
+            Group: "enterprise.splunk.com",
+            Kind:  "<CRD>",
+        },
+    },
+}
+```
+
+### 3. Add Unit Tests
+
+Create `pkg/splunk/enterprise/validation/<crd>_validation_test.go` with test cases.
+
+### 4. Update ValidatingWebhookConfiguration
+
+Add the new resource to `config/webhook/manifests.yaml`:
+
+```yaml
+webhooks:
+  - name: validate.enterprise.splunk.com
+    rules:
+      - apiGroups: ["enterprise.splunk.com"]
+        apiVersions: ["v4"]
+        operations: ["CREATE", "UPDATE"]
+        resources:
+          - standalones
+          - indexerclusters
+          - <crd>s  # Add new resource here
+```
+
+### Context-Aware vs Basic Validation
+
+- **Basic validation** (`ValidateCreateFunc`): For validations that only need the CR itself (field formats, required fields, cross-field rules)
+- **Context-aware validation** (`ValidateCreateWithContextFunc`): For validations that need to query the Kubernetes API (checking if Secrets, ConfigMaps, or other resources exist)
+
+If your CRD doesn't need context-aware validation, you can omit `ValidateCreateWithContextFunc` and `ValidateUpdateWithContextFunc` - the webhook will automatically fall back to the basic validation functions.
+
 ## Disabling the Webhook
 
 To disable the webhook after it has been enabled:

pkg/splunk/enterprise/validation/clustermanager_validation.go

@@ -42,12 +42,27 @@ func ValidateClusterManagerCreate(obj *enterpriseApi.ClusterManager) field.Error
 	return allErrs
 }
 
+// ValidateClusterManagerCreateWithContext validates a ClusterManager on CREATE with ValidationContext
+func ValidateClusterManagerCreateWithContext(obj *enterpriseApi.ClusterManager, vc *ValidationContext) field.ErrorList {
+	allErrs := ValidateClusterManagerCreate(obj)
+	if len(obj.Spec.ImagePullSecrets) > 0 {
+		allErrs = append(allErrs, ValidateImagePullSecretsExistence(
+			obj.Spec.ImagePullSecrets, vc, field.NewPath("spec").Child("imagePullSecrets"))...)
+	}
+	return allErrs
+}
+
 // ValidateClusterManagerUpdate validates a ClusterManager on UPDATE
 // TODO: Add immutable field validation here (e.g., compare obj vs oldObj for fields that cannot change after creation)
 func ValidateClusterManagerUpdate(obj, oldObj *enterpriseApi.ClusterManager) field.ErrorList {
 	return ValidateClusterManagerCreate(obj)
 }
 
+// ValidateClusterManagerUpdateWithContext validates a ClusterManager on UPDATE with ValidationContext
+func ValidateClusterManagerUpdateWithContext(obj, oldObj *enterpriseApi.ClusterManager, vc *ValidationContext) field.ErrorList {
+	return ValidateClusterManagerCreateWithContext(obj, vc)
+}
+
 // GetClusterManagerWarningsOnCreate returns warnings for ClusterManager CREATE
 func GetClusterManagerWarningsOnCreate(obj *enterpriseApi.ClusterManager) []string {
 	return getCommonWarnings(&obj.Spec.CommonSplunkSpec)