Remove Webhooks in Favor of OpenAPI/CEL CRD Validation

[kubernetes-sigs]

Remove Webhooks in Favor of OpenAPI/CEL CRD Validation

[ellistarn]

We haven't gone through the exercise of using builtin CRD validation. The defaults are provider specific. See: https://github.com/aws/karpenter/blob/main/pkg/apis/v1alpha5/provisioner.go#L45. I'd be curious to see if you could replace the validation webhooks.

[dudicoco]

We haven't gone through the exercise of using builtin CRD validation.

@ellistarn can you please elaborate on that?
It is much easier to add some fields to the CRD schema than writing additional code to validate it.
For example the following code could be easily replaced with a required: ["evictionSoftGracePeriod"] block within the schema.

I believe the defaulting webhook could also be avoided by adding default fields within the CRD schema.

[ellistarn]

Interesting ideas. Would you be interested in contributing this?

[dudicoco]

@ellistarn sure.
Should I open a PR for the CRDs changes?

[ellistarn]

Sure thing!

[github-actions]

Labeled for closure due to inactivity in 10 days.

[github-actions]

Labeled for closure due to inactivity in 10 days.

[jonathan-innis]

Kubernetes supports CEL for CRD validation. We should investigate this along with the other validations that are supported natively by the Open API specs (like defaults, minimum, maximums, etc.)