WIP: Finish "IP sloppy" removal

.github/workflows/validation-gen-ci-test.yml

@@ -0,0 +1,46 @@
+name: validation-gen CI Tests
+
+on:
+  pull_request:
+    branches:
+      - "main"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v3
+
+    - name: Set up Go
+      uses: actions/setup-go@v4
+
+    - name: Run code generation and check for diffs
+      run: |
+        hack/update-codegen.sh validation
+        git diff --exit-code
+
+    - name: Run gofmt and check for diffs
+      run: |
+        hack/verify-gofmt.sh
+        git diff --exit-code
+
+    - name: Run golangci-lint CI Test
+      run: |
+        hack/verify-golangci-lint.sh
+
+    - name: Run validation-gen go tests and also check for diffs with generated test fixture code
+      env: 
+        UPDATE_VALIDATION_GEN_FIXTURE_DATA: "true"
+      run: |
+        go test ./staging/src/k8s.io/code-generator/cmd/validation-gen/...
+        go test ./staging/src/k8s.io/apimachinery/pkg/api/...
+        go test ./staging/src/k8s.io/apimachinery/pkg/util/...
+        go test ./pkg/api/testing/...
+        go test ./pkg/apis/autoscaling/validation/...
+        go test ./pkg/registry/core/replicationcontroller/...
+        go test ./pkg/registry/certificates/certificates/...
+        go test ./pkg/apis/autoscaling/validation/...
+        git diff --exit-code
+

go.mod

@@ -215,7 +215,7 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
+	k8s.io/gengo/v2 v2.0.0-20250903151518-081d64401ab4 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/kustomize/api v0.20.1 // indirect

go.sum

@@ -474,8 +474,8 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
-k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f h1:SLb+kxmzfA87x4E4brQzB33VBbT2+x7Zq9ROIHmGn9Q=
-k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
+k8s.io/gengo/v2 v2.0.0-20250903151518-081d64401ab4 h1:I8k0vOOD2ZQWs3PtYXC0mjJdlIMriS0O/N+RjSkWB48=
+k8s.io/gengo/v2 v2.0.0-20250903151518-081d64401ab4/go.mod h1:CgujABENc3KuTrcsdpGmrrASjtQsWCT7R99mEV4U/fM=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=

pkg/apis/admissionregistration/types.go

@@ -1033,16 +1033,18 @@ type MutatingWebhook struct {
 	MatchConditions []MatchCondition
 }
 
-// ReinvocationPolicyType specifies what type of policy the admission hook uses.
+// ReinvocationPolicyType specifies what type of policy is used when other admission plugins also perform
+// modifications.
+// +enum
 type ReinvocationPolicyType string
 
 var (
-	// NeverReinvocationPolicy indicates that the webhook must not be called more than once in a
+	// NeverReinvocationPolicy indicates that the mutation must not be called more than once in a
 	// single admission evaluation.
 	NeverReinvocationPolicy ReinvocationPolicyType = "Never"
-	// IfNeededReinvocationPolicy indicates that the webhook may be called at least one
+	// IfNeededReinvocationPolicy indicates that the mutation may be called at least one
 	// additional time as part of the admission evaluation if the object being admitted is
-	// modified by other admission plugins after the initial webhook call.
+	// modified by other admission plugins after the initial mutation call.
 	IfNeededReinvocationPolicy ReinvocationPolicyType = "IfNeeded"
 )
 

pkg/apis/apiserverinternal/validation/validation_test.go

@@ -430,13 +430,13 @@ func TestValidateStorageVersionName(t *testing.T) {
 		expectedErr: "",
 	}, {
 		name:        strings.Repeat("x", 254) + ".tokenreviews",
-		expectedErr: `the group segment must be no more than 253 characters`,
+		expectedErr: `the group segment must be no more than 253 bytes`,
 	}, {
 		name:        "authentication.k8s.io." + strings.Repeat("x", 63),
 		expectedErr: "",
 	}, {
 		name:        "authentication.k8s.io." + strings.Repeat("x", 64),
-		expectedErr: `the resource segment must be no more than 63 characters`,
+		expectedErr: `the resource segment must be no more than 63 bytes`,
 	}}
 	for _, tc := range cases {
 		errs := ValidateStorageVersionName(tc.name, false)

pkg/apis/autoscaling/validation/declarative_validation_test.go

@@ -32,7 +32,7 @@ import (
 	"k8s.io/kubernetes/pkg/features"
 )
 
-func TestValidateScaleForDeclarative(t *testing.T) {
+func TestScaleDeclarativeValidation(t *testing.T) {
 	ctx := genericapirequest.WithRequestInfo(genericapirequest.NewDefaultContext(), &genericapirequest.RequestInfo{
 		APIGroup:    "autoscaling",
 		APIVersion:  "v1",

pkg/apis/autoscaling/validation/validation.go

@@ -50,7 +50,7 @@ func ValidateScale(scale *autoscaling.Scale) field.ErrorList {
 
 // ValidateHorizontalPodAutoscalerName can be used to check whether the given autoscaler name is valid.
 // Prefix indicates this name will be used as part of generation, in which case trailing dashes are allowed.
-var ValidateHorizontalPodAutoscalerName = apivalidation.ValidateReplicationControllerName
+var ValidateHorizontalPodAutoscalerName = apimachineryvalidation.NameIsDNSSubdomain
 
 func validateHorizontalPodAutoscalerSpec(autoscaler autoscaling.HorizontalPodAutoscalerSpec, fldPath *field.Path, opts HorizontalPodAutoscalerSpecValidationOptions) field.ErrorList {
 	allErrs := field.ErrorList{}

pkg/apis/batch/validation/validation.go

@@ -26,6 +26,8 @@ import (
 	"github.com/robfig/cron/v3"
 
 	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	apimachineryapivalidation "k8s.io/apimachinery/pkg/api/validation"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	unversionedvalidation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
 	"k8s.io/apimachinery/pkg/labels"
@@ -150,7 +152,7 @@ func validateGeneratedSelector(obj *batch.Job, validateBatchLabels bool) field.E
 // ValidateJob validates a Job and returns an ErrorList with any errors.
 func ValidateJob(job *batch.Job, opts JobValidationOptions) field.ErrorList {
 	// Jobs and rcs have the same name validation
-	allErrs := apivalidation.ValidateObjectMeta(&job.ObjectMeta, true, apivalidation.ValidateReplicationControllerName, field.NewPath("metadata"))
+	allErrs := apivalidation.ValidateObjectMeta(&job.ObjectMeta, true, apimachineryapivalidation.NameIsDNSSubdomain, field.NewPath("metadata"))
 	allErrs = append(allErrs, validateGeneratedSelector(job, opts.RequirePrefixedLabels)...)
 	allErrs = append(allErrs, ValidateJobSpec(&job.Spec, field.NewPath("spec"), opts.PodValidationOptions)...)
 	if job.Spec.CompletionMode != nil && *job.Spec.CompletionMode == batch.IndexedCompletion && job.Spec.Completions != nil && *job.Spec.Completions > 0 {
@@ -714,14 +716,14 @@ func ValidateJobStatusUpdate(job, oldJob *batch.Job, opts JobStatusValidationOpt
 // ValidateCronJobCreate validates a CronJob on creation and returns an ErrorList with any errors.
 func ValidateCronJobCreate(cronJob *batch.CronJob, opts apivalidation.PodValidationOptions) field.ErrorList {
 	// CronJobs and rcs have the same name validation
-	allErrs := apivalidation.ValidateObjectMeta(&cronJob.ObjectMeta, true, apivalidation.ValidateReplicationControllerName, field.NewPath("metadata"))
+	allErrs := apivalidation.ValidateObjectMeta(&cronJob.ObjectMeta, true, apimachineryapivalidation.NameIsDNSSubdomain, field.NewPath("metadata"))
 	allErrs = append(allErrs, validateCronJobSpec(&cronJob.Spec, nil, field.NewPath("spec"), opts)...)
-	if len(cronJob.ObjectMeta.Name) > apimachineryvalidation.DNS1035LabelMaxLength-11 {
+	if max := apimachineryvalidation.DNS1035LabelMaxLength - 11; len(cronJob.Name) > max {
 		// The cronjob controller appends a 11-character suffix to the cronjob (`-$TIMESTAMP`) when
 		// creating a job. The job name length limit is 63 characters.
 		// Therefore cronjob names must have length <= 63-11=52. If we don't validate this here,
 		// then job creation will fail later.
-		allErrs = append(allErrs, field.Invalid(field.NewPath("metadata").Child("name"), cronJob.ObjectMeta.Name, "must be no more than 52 characters"))
+		allErrs = append(allErrs, field.Invalid(field.NewPath("metadata").Child("name"), cronJob.Name, content.MaxLenError(max)))
 	}
 	return allErrs
 }

pkg/apis/batch/validation/validation_test.go

@@ -2773,7 +2773,7 @@ func TestValidateCronJob(t *testing.T) {
 				},
 			},
 		},
-		"metadata.name: must be no more than 52 characters": {
+		"metadata.name: must be no more than 52 bytes": {
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "10000000002000000000300000000040000000005000000000123",
 				Namespace: metav1.NamespaceDefault,
@@ -2885,7 +2885,7 @@ func TestValidateCronJob(t *testing.T) {
 
 			errs = ValidateCronJobUpdate(&newSpec, &oldSpec, corevalidation.PodValidationOptions{})
 			if len(errs) == 0 {
-				if k == "metadata.name: must be no more than 52 characters" {
+				if k == "metadata.name: must be no more than 52 bytes" {
 					return
 				}
 				t.Errorf("expected failure for %s", k)