Retool how validators register and are called: everything's a tag!

go.mod

@@ -214,7 +214,7 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/gengo/v2 v2.0.0-20250106234829-0359904fc2a6 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.1 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/kustomize/api v0.18.0 // indirect

staging/src/k8s.io/apiextensions-apiserver/go.mod

@@ -123,7 +123,7 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/gengo/v2 v2.0.0-20250106234829-0359904fc2a6 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 // indirect
 	k8s.io/kms v0.0.0 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.1 // indirect
 )

staging/src/k8s.io/apimachinery/pkg/api/safe/safe.go

@@ -76,47 +76,3 @@ func Cast[T any](value any) T {
 	result, _ := value.(T)
 	return result
 }
-
-// NewListMap creates a ListMap from the given elements and keyer.
-func NewListMap[T any, K comparable](elements []T, keyer func(v *T) K) *ListMap[T, K] {
-	if len(elements) == 0 { // optimize for empty maps since this is a common case
-		return nil
-	}
-	keyed := map[K]*T{}
-	for i := range elements {
-		e := &elements[i]
-		keyed[keyer(e)] = e
-	}
-	return &ListMap[T, K]{Map: keyed, Keyer: keyer}
-}
-
-// ListMap provides map access to a slice where each element in the slice
-// has a key that can be computed from the element by the provided keyer function.
-type ListMap[T any, K comparable] struct {
-	Map   map[K]*T
-	Keyer func(v *T) K
-}
-
-// Get returns the element in the ListMap matching the key, or nil if there is no matching element.
-func (lm *ListMap[T, K]) Get(key K) *T {
-	if lm == nil {
-		return nil
-	}
-	if v, ok := lm.Map[key]; ok {
-		return v
-	}
-	return nil
-}
-
-// WithMatchingKey finds the element in the ListMap with the same key and returns it,
-// or returns nil if no matching element was found.
-func (lm *ListMap[T, K]) WithMatchingKey(value T) *T {
-	if lm == nil {
-		return nil
-	}
-	k := lm.Keyer(&value)
-	if v, ok := lm.Map[k]; ok {
-		return v
-	}
-	return nil
-}

staging/src/k8s.io/apimachinery/pkg/api/validate/common.go

@@ -0,0 +1,26 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ValidateFunc is a function that validates a value, possibly considering the
+// old value (if any).
+type ValidateFunc[T any] func(opCtx operation.Context, fldPath *field.Path, newValue, oldValue T) field.ErrorList

staging/src/k8s.io/apimachinery/pkg/api/validate/content/README.md

@@ -12,3 +12,5 @@ but they should still use a slice return type.
 
 Good validation failure messages follow the Kubernetes API conventions, for
 example using "must" instead of "should".
+
+This package should have almost no external dependecies (except stdlib).

staging/src/k8s.io/apimachinery/pkg/api/validate/content/dns.go

@@ -18,6 +18,7 @@ package content
 
 import (
 	"regexp"
+	"strings"
 	"unicode"
 )
 
@@ -32,37 +33,98 @@ const DNS1123LabelMaxLength int = dns1123LabelMaxLength
 
 var dnsLabelRegexp = regexp.MustCompile("^" + dns1123LabelInteriorFmt + "$")
 
-// IsDNS1123Label returns error messages if the specified value does not
-// parse as per the definition of a label in DNS (approximately RFC 1123).
+// IsDNS1123Label returns error messages if the specified value is not
+// a valid DNS "label" (approximately RFC 1123).
 func IsDNS1123Label(value string) []string {
-	var errs []string
 	if len(value) > dns1123LabelMaxLength {
-		errs = append(errs, MaxLenError(dns1123LabelMaxLength))
-		return errs // Don't run further validation if we know it is too long.
-	}
-	if len(value) == 0 {
-		errs = append(errs, "must contain at least 1 character")
-		return errs // No point in going further.
+		// Don't run further validation if we know it is too long.
+		return []string{MaxLenError(dns1123LabelMaxLength)}
 	}
+	return isDNS1123LabelExceptMaxLength(value)
+}
 
-	isAlNum := func(r rune) bool {
-		if r > unicode.MaxASCII {
-			return false
-		}
-		if unicode.IsLetter(r) && unicode.IsLower(r) {
-			return true
-		}
-		if unicode.IsDigit(r) {
-			return true
-		}
+func isAlNumLower(r rune) bool {
+	if r > unicode.MaxASCII {
 		return false
 	}
+	if unicode.IsLetter(r) && unicode.IsLower(r) {
+		return true
+	}
+	if unicode.IsDigit(r) {
+		return true
+	}
+	return false
+}
+
+// Due to historical reasons, we need to be able to validate the format of a
+// label without checking the max length.
+func isDNS1123LabelExceptMaxLength(value string) []string {
+	if len(value) == 0 {
+		// No point in going further.
+		return []string{EmptyError()}
+	}
+
+	var errs []string
+
 	runes := []rune(value)
-	if !isAlNum(runes[0]) || !isAlNum(runes[len(runes)-1]) {
+	if !isAlNumLower(runes[0]) || !isAlNumLower(runes[len(runes)-1]) {
 		errs = append(errs, "must start and end with lower-case alphanumeric characters")
 	}
 	if len(runes) > 2 && !dnsLabelRegexp.MatchString(string(runes[1:len(runes)-1])) {
 		errs = append(errs, "must contain only lower-case alphanumeric characters or '-'")
 	}
 	return errs
 }
+
+const dns1123SubdomainMaxLength int = 253
+
+// DNS1123SubdomainMaxLength is a DNS subdomain's max length (RFC 1123).
+const DNS1123SubdomainMaxLength int = dns1123SubdomainMaxLength
+
+// IsDNS1123Subdomain returns error messages if the specified value is not
+// a valid DNS "subdomain" (approximately RFC 1123).
+// subdomain in DNS (RFC 1123).
+func IsDNS1123Subdomain(value string) []string {
+	if len(value) > DNS1123SubdomainMaxLength {
+		// Don't run further validation if we know it is too long.
+		return []string{MaxLenError(dns1123SubdomainMaxLength)}
+	}
+	if len(value) == 0 {
+		// No point in going further.
+		return []string{EmptyError()}
+	}
+
+	var errs []string
+
+	trimmed := strings.Trim(value, ".")
+	if trimmed != value {
+		errs = append(errs, "must start and end with lower-case alphanumeric characters")
+	}
+
+	value = strings.Trim(value, ".")
+	if len(value) > 0 {
+		parts := strings.Split(value, ".")
+		for _, part := range parts {
+			if msgs := isDNS1123LabelExceptMaxLength(part); len(msgs) > 0 {
+				// We don't need duplicate errors, but each part might have
+				// different errors. Making a set for such little data is expensive.
+				for _, msg := range msgs {
+					msg := "each part " + msg
+					if !msgExists(errs, msg) {
+						errs = append(errs, msg)
+					}
+				}
+			}
+		}
+	}
+	return errs
+}
+
+func msgExists(haystack []string, needle string) bool {
+	for _, msg := range haystack {
+		if msg == needle {
+			return true
+		}
+	}
+	return false
+}

staging/src/k8s.io/apimachinery/pkg/api/validate/content/dns_test.go

@@ -94,3 +94,134 @@ func TestIsDNS1123Label(t *testing.T) {
 		testVerify(t, i, tc.input, tc.expect, result)
 	}
 }
+
+func TestIsDNS1123Subdomain(t *testing.T) {
+	// errors expected
+	const minSizeError = "must contain at least 1 character"
+	const partMinSizeError = "each part must contain at least 1 character"
+	const maxSizeError = "must be no more than 253 characters"
+	const startEndError = "must start and end with lower-case alphanumeric characters"
+	const partStartEndError = "each part must start and end with lower-case alphanumeric characters"
+	const partInteriorError = "each part must contain only lower-case alphanumeric characters or '-'"
+
+	cases := []struct {
+		input  string
+		expect []string // regexes
+	}{
+		// Good values
+		{"a", nil},
+		{"ab", nil},
+		{"abc", nil},
+		{"a1", nil},
+		{"a-1", nil},
+		{"a--1--2--b", nil},
+		{"0", nil},
+		{"01", nil},
+		{"012", nil},
+		{"1a", nil},
+		{"1-a", nil},
+		{"1--a--b--2", nil},
+		{strings.Repeat("a", 63), nil},
+		{strings.Repeat("a", 64), nil},  // allowed for backwards compat
+		{strings.Repeat("a", 253), nil}, // allowed for backwards compat
+		{"a.a", nil},
+		{"ab.a", nil},
+		{"abc.a", nil},
+		{"a1.a", nil},
+		{"a-1.a", nil},
+		{"a--1--2--b.a", nil},
+		{"0.a", nil},
+		{"01.a", nil},
+		{"012.a", nil},
+		{"1a.a", nil},
+		{"1-a.a", nil},
+		{"1--a--b--2.a", nil},
+		{strings.Repeat("a", 63) + ".a", nil},
+		{strings.Repeat("a", 64) + ".a", nil},  // allowed for backwards compat
+		{strings.Repeat("a", 251) + ".a", nil}, // allowed for backwards compat
+		{"a.1", nil},
+		{"ab.1", nil},
+		{"abc.1", nil},
+		{"a1.1", nil},
+		{"a-1.1", nil},
+		{"a--1--2--b.1", nil},
+		{"0.1", nil},
+		{"01.1", nil},
+		{"012.1", nil},
+		{"1a.1", nil},
+		{"1-a.1", nil},
+		{"1--a--b--2.1", nil},
+		{strings.Repeat("a", 63) + ".1", nil},
+		{strings.Repeat("a", 64) + ".1", nil},  // allowed for backwards compat
+		{strings.Repeat("a", 251) + ".1", nil}, // allowed for backwards compat
+		{"a.b.c.d.e", nil},
+		{"aa.bb.cc.dd.ee", nil},
+		{"1.2.3.4.5", nil},
+		{"11.22.33.44.55", nil},
+		{strings.Repeat("a", 126) + "." + strings.Repeat("b", 126), nil},
+		{strings.Repeat("0", 126) + "." + strings.Repeat("1", 126), nil},
+		{strings.Repeat("0.", 126) + "0", nil},
+
+		// Bad values
+		{"", mkMsgs(minSizeError)},
+		{"A", mkMsgs(startEndError)},
+		{"ABC", mkMsgs(startEndError, partInteriorError)},
+		{"aBc", mkMsgs(partInteriorError)},
+		{"AbC", mkMsgs(startEndError)},
+		{"A1", mkMsgs(startEndError)},
+		{"A-1", mkMsgs(startEndError)},
+		{"1-A", mkMsgs(startEndError)},
+		{"-", mkMsgs(startEndError)},
+		{"a-", mkMsgs(startEndError)},
+		{"-a", mkMsgs(startEndError)},
+		{"1-", mkMsgs(startEndError)},
+		{"-1", mkMsgs(startEndError)},
+		{"_", mkMsgs(startEndError)},
+		{"a_", mkMsgs(startEndError)},
+		{"_a", mkMsgs(startEndError)},
+		{"a_b", mkMsgs(partInteriorError)},
+		{"1_", mkMsgs(startEndError)},
+		{"_1", mkMsgs(startEndError)},
+		{"1_2", mkMsgs(partInteriorError)},
+		{".", mkMsgs(startEndError)},
+		{"a.", mkMsgs(startEndError)},
+		{".a", mkMsgs(startEndError)},
+		{"1.", mkMsgs(startEndError)},
+		{".1", mkMsgs(startEndError)},
+		{"a..b", mkMsgs(partMinSizeError)},
+		{"0..1", mkMsgs(partMinSizeError)},
+		{" ", mkMsgs(startEndError)},
+		{"a ", mkMsgs(startEndError)},
+		{" a", mkMsgs(startEndError)},
+		{"a b", mkMsgs(partInteriorError)},
+		{"1 ", mkMsgs(startEndError)},
+		{" 1", mkMsgs(startEndError)},
+		{"1 2", mkMsgs(partInteriorError)},
+		{"A.b", mkMsgs(startEndError)},
+		{"aB.b", mkMsgs(partStartEndError)},
+		{"ab.A", mkMsgs(startEndError)},
+		{"A.0", mkMsgs(startEndError)},
+		{"0B.0", mkMsgs(partStartEndError)},
+		{"00.A", mkMsgs(startEndError)},
+		{"A.B.C.D.E", mkMsgs(startEndError)},
+		{"AA.BB.CC.DD.EE", mkMsgs(startEndError)},
+		{"a.B.c.d.e", mkMsgs(startEndError)},
+		{"aa.bB.cc.dd.ee", mkMsgs(startEndError)},
+		{"a@b", mkMsgs(partInteriorError)},
+		{"a,b", mkMsgs(partInteriorError)},
+		{"a_b", mkMsgs(partInteriorError)},
+		{"a;b", mkMsgs(partInteriorError)},
+		{"a:b", mkMsgs(partInteriorError)},
+		{`a%b`, mkMsgs(partInteriorError)},
+		{"a?b", mkMsgs(partInteriorError)},
+		{"a$b", mkMsgs(partInteriorError)},
+		{strings.Repeat("a", 254), mkMsgs(maxSizeError)},
+		{strings.Repeat("-", 254), mkMsgs(maxSizeError)},
+		{strings.Repeat(".", 254), mkMsgs(maxSizeError)},
+	}
+
+	for i, tc := range cases {
+		result := IsDNS1123Subdomain(tc.input)
+		testVerify(t, i, tc.input, tc.expect, result)
+	}
+}

staging/src/k8s.io/apimachinery/pkg/api/validate/content/errors.go

@@ -25,3 +25,8 @@ import (
 func MaxLenError(length int) string {
 	return fmt.Sprintf("must be no more than %d characters", length)
 }
+
+// EmptyError returns a string explanation of an "empty string" validation.
+func EmptyError() string {
+	return "must contain at least 1 character"
+}