KEP-5073: Declarative Validation: Explain and update document with cross-field field reference validation information

[aaron-prindle]

One-line PR description: This addresses how we intend to handle referencing fields for cross-field validations with Declarative Validation.

Issue link: #5073

[aaron-prindle]

/assign @deads2k @jpbetz @thockin
/cc @yongruilin

[jpbetz]

Can we switch examples?

How about we use the union example for virtual fields, and we use the min/max example for field paths?

I think this better highlights our best practices.

If we ever do need min/max to support references we can add that, but it feels more natural to use the simple sibling reference approach for the common case.

[aaron-prindle]

I have changed this example to be as suggested. The field path section uses a min/max example currently so I believe we are good there. The initial idea was to show how to use all the tags in the virtual field but I agree it is better to show the best practice/practical cases.

[jpbetz]

Oh interesting. Here, maxCpu references the MaxCpu field of Config using a field path? This implies that the field path is relative to the Config and not SettingsConfig, which was not immediately obvious to me because this tag is injected into the SettingsConfig type with subfield.

[aaron-prindle]

This is based off the below section in the original DD:

Field Path Resolution & Chained Tags
Explicit Path Context: Field paths always resolve from the original tag location

// 'minValue' always refers to Config.MinValue, not Nested siblings
type Config struct {
  MinValue int
  // +k8s:subfield(nestedCurrent)=+k8s:minimum(limit: minValue)
  Nested Nested
}

type Nested struct {
  NestedCurrent int
}

In thinking through the implications of this though, it is not feasible with the current implementation of subfield. This would be a potential case to use +k8s:reference. I will remove this tag examples for now as I don't believe there are actually any subfield cases on shared objects that have cross-field validation with the parent object

[deads2k]

questions

[yongruilin]

Need to update the above table for +k8s:union(...).
Actually, I'm unclear about the union tag usage here. Is it only used for declaring the group?

[aaron-prindle]

The KEP differs from the tags in the dev-branch which need to be updated to be in line with this KEP Update. In the dev branch there is +k8s:unionMember which has implicit virtual fields for the groups. For +k8s:unionMember that tag is essentially +k8s:union and +k8s:memberOf in a single tag. This KEP Update decouples these concepts to have a generic way of grouping fields via virtual fields and then having +k8s:union consume the virtual field grouping.

+k8s:union in this case is the only tag in this example that validates exclusivity for each member in the group terminalStatus. +k8s:memberOf generically groups the values

[deads2k]

this is in addition to https://github.com/kubernetes/enhancements/pull/5290/files?diff=split&w=0#diff-ee5e894a755c55c5e78fa01f4d06cfc09d7ea1868f3c6ee1e905da474fe00352R1048, right?

[aaron-prindle]

this is in addition to https://github.com/kubernetes/enhancements/pull/5290/files?diff=split&w=0#diff-ee5e894a755c55c5e78fa01f4d06cfc09d7ea1868f3c6ee1e905da474fe00352R1048, right?

Yes, there will be a separate KEP update to address the tags/approach to immutability

EDIT: This is submitted and out for review now: https://github.com/kubernetes/enhancements/pull/5373/files

[deads2k]

lgtm. I see Joe has a review on this too

/assign @jpbetz

[jpbetz]

/lgtm
/approve

This sets up a solid set of core principals to build on. Thanks!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aaron-prindle, jpbetz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• keps/sig-api-machinery/OWNERS [jpbetz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment