Generated Metadata breaks crd in 1.15

[skonto]

Details are described in kubernetes/kubernetes#80493. Initially I thought that this might be a k8s issue but it looks now like an incompatibility issue for controller-tools.

The problem is that the default preserveUnknownFields: true in combination with

  annotations:
    certmanager.k8s.io/inject-ca-from: test-operator-system/test-operator-serving-cert

and

conversion:
    strategy: Webhook
    webhookClientConfig:
      caBundle: Cg==
      service:
        name: test-operator-webhook-service
        namespace: test-operator-system
        path: /convert

create this error The CustomResourceDefinition "cronjobs.batch.tutorial.kubebuilder.io" is invalid: spec.conversion.strategy: Invalid value: "Webhook": must be None if spec.preserveUnknownFields is true

If you set preserveUnknownFields: false to make conversion work then immediately you get:

> The CustomResourceDefinition "testapplications.testoperator.k8s.io" is invalid: spec.validation.openAPIV3Schema.properties[metadata]: Forbidden: must not specify anything other than name and generateName, but metadata is implicitly specified

[skonto]

@DirectXMan12 am I missing something here? I dont see any docs about the above requirements in https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definition-versioning btw, but code is there.

[skonto]

I verified that this works with 1.14.2 but not 1.15.{0,1}, tested with minikube and --feature-gates CustomResourceWebhookConversion=true for 1.14.2.

[liggitt]

preserveUnknownFields is a new field in 1.15. Anything setting preserveUnknownFields: false is opting into structural schema validation and must comply with all the structural requirements (see https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#specifying-a-structural-schema), including:

if metadata is specified, then only restrictions on metadata.name and metadata.generateName are allowed.

[liggitt]

And you are correct, structural schema is required to make use of webhook conversion

[DirectXMan12]

we should be no longer specifying validation for objectmeta in the latest versions of controller-tools, in part due to this issue.

[DirectXMan12]

can you retry with beta.5?

[ncdc]

@DirectXMan12 I'm seeing this too with beta.5. Still digging into it but wanted to report it here.

[ncdc]

Or rather, preserveUnknownFields is still true (the metadata validation is correctly switched to object).

[ncdc]

If I manually set preserveUnknownFields, I'm able to deploy everything.

[ncdc]

Aha, we need #281

[voelzmo]

Just found this as well when using kubebuilder on 1.15.3
I'm not sure how to fix this currently – can I do some manual changes until #281 finds its way?

[jgustie]

I found that v1beta1 generated CRDs that use IntOrString are problematic because of the use of x-kubernetes-int-or-string: this seems to force the use of structural schemas on the API side regardless of if preserveUnknownFields is explicitly set to "true" or left unset (and structural schema validation currently fails because of the inclusion of metadata definitions).

Manually removing the x-kubernetes-* lines from the v1beta1 generated CRDs allows me to deploy them.