Migrate Admission Controller Validation to CEL

[omerap12]

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR migrates the admission controller validation to use CEL (Common Expression Language) for improved flexibility and consistency in validation logic at the API server level.

Which issue(s) this PR fixes:

Fixes #7665

Special notes for your reviewer:

Does this PR introduce a user-facing change?

The validation process is now handled using CEL at the API server level. Expect different validation messages as a result.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

NONE

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[omerap12]

I've tested it locally and it works, but I still need to add integration tests. Can you check if it looks good to you?
@adrianmoisey
@voelzmo

[adrianmoisey]

Whoa! That is neat!
I didn't know that the validation could happen in the CRD itself.

Two questions:

1. The CRD is generated, I assume these CEL rules need to be configured in the types somewhere, so they are outputted to the generated CRD
2. Moving these to CELs means the tests move from unit tests to e2e tests, what does that look like?

[omerap12]

Whoa! That is neat!

I didn't know that the validation could happen in the CRD itself.

Two questions:

1. The CRD is generated, I assume these CEL rules need to be configured in the types somewhere, so they are outputted to the generated CRD

2. Moving these to CELs means the tests move from unit tests to e2e tests, what does that look like?

Yup!

Regarding point 1, I need to explore how to configure it, but kubebuilder annotations do support this.
As for point 2, I haven’t implemented the tests yet, but that is the intended approach (this is one of the downsides of this method).

[adrianmoisey]

Regarding point 1, I need to explore how to configure it, but kubebuilder annotations do support this.

Yup, I see https://book.kubebuilder.io/reference/markers/crd-validation has these listed

[omerap12]

Regarding point 1, I need to explore how to configure it, but kubebuilder annotations do support this.

Yup, I see https://book.kubebuilder.io/reference/markers/crd-validation has these listed

Now it was generated by kubebuilder.

[omerap12]

Tests are failing because of the change I made in the admission controller, so we should migrate those tests into e2e/integration tests.

[voelzmo]

I don't think you can introduce new CRD validations without increasing the apiVersion.

Additionally, containerName: '*' is explicitly supported as a catch-all solution, see

autoscaler/vertical-pod-autoscaler/pkg/utils/vpa/api.go

Lines 216 to 218 in adda3d4

	if containerPolicy.ContainerName == vpa_types.DefaultContainerResourcePolicy {
	defaultPolicy = &policy.ContainerPolicies[i]
	}

[omerap12]

1. Yes you are right it's just WIP at the moment.
2. Thanks, I will adjust :)

[voelzmo]

I don't see any checks added regarding updatePolicy.updateMode – is this intentional and those checks are implicitly done somewhere else now? Or do we need to add them as CEL validations as well?

[omerap12]

In the CRD itself I saw this:
https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/deploy/vpa-v1-crd-gen.yaml#L456

So added in here: ea90c23

[voelzmo]

Sorry, didn't mean to approve 🙈

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: omerap12
Once this PR has been reviewed and has the lgtm label, please assign jbartosik for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• vertical-pod-autoscaler/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment