Kong · pmalek · Apr 15, 2025 · Apr 15, 2025
@@ -0,0 +1,3 @@
+- node_image: kindest/node:v1.32.2@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f
+- node_image: kindest/node:v1.31.6@sha256:28b7cbb993dfe093c76641a0c95807637213c9109b761f1d422c2400e22b8e87
+- node_image: kindest/node:v1.30.10@sha256:4de75d0e82481ea846c0ed1de86328d821c1e6a6a91ac37bf804e5313670e507
@@ -106,8 +106,28 @@ jobs:
 
     - run: make lint
 
+  matrix_k8s_node_images:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - id: set-matrix
+        run: |
+          (
+            echo 'matrix<<EOF'
+            yq eval -o=json '.' .github/supported_k8s_node_images.yaml
+            echo 'EOF'
+          ) >> "${GITHUB_OUTPUT}"
+
   apply:
     runs-on: ubuntu-latest
+    needs:
+    - matrix_k8s_node_images
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.matrix_k8s_node_images.outputs.matrix) }}
+
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
@@ -121,6 +141,11 @@ jobs:
 
     - name: Create k8s KinD Cluster
       uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+      with:
+        # NOTE: default is 0.26.0 https://github.com/helm/kind-action/blob/a1b0e391336a6ee6713a0583f8c6240d70863de3/kind.sh#L21
+        # so bump this manually
+        version: v0.27.0
+        node_image: ${{ matrix.node_image }}
 
     - name: Verify installing CRDs via kustomize works
       run: make install
@@ -130,6 +155,12 @@ jobs:
 
   CRDs-validation:
     runs-on: ubuntu-latest
+    needs:
+    - matrix_k8s_node_images
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.matrix_k8s_node_images.outputs.matrix) }}
+
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
@@ -143,6 +174,11 @@ jobs:
 
     - name: Create k8s KinD Cluster
       uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+      with:
+        # NOTE: default is 0.26.0 https://github.com/helm/kind-action/blob/a1b0e391336a6ee6713a0583f8c6240d70863de3/kind.sh#L21
+        # so bump this manually
+        version: v0.27.0
+        node_image: ${{ matrix.node_image }}
 
     - name: Verify installing CRDs via kustomize works
       run: make install

@@ -30,6 +30,10 @@ Adding a new version? You'll need three changes:
   [#381](https://github.com/Kong/kubernetes-configuration/pull/381)
 - Add Type and KonnectID fields to the `KonnectGatewayControlPlane` CRD.
   [#387](https://github.com/Kong/kubernetes-configuration/pull/387)
+- Removed `namespace` field validation on `KonnectConfigurationDataPlaneGroup` `networkRef` field.
+  Using CEL reserved keywords is only available in Kubernetes 1.32+.
+  Added CRD validation test for all supported Kubernetes versions.
+  [#394](https://github.com/Kong/kubernetes-configuration/pull/394)
 
 ## [v1.3.1]
 

@@ -92,8 +92,11 @@ type KonnectConfigurationDataPlaneGroup struct {
 
 	// NetworkRef is the reference to the network that this data-plane group will be deployed on.
 	//
+	// Cross namespace references are not supported for networkRef of type namespacedRef.
+	// This will be enforced in the future but currently (due to limitation in CEL validation
+	// in Kubernetes 1.31 and older) it is not.
+	//
 	// +kubebuilder:validation:Required
-	// +kubebuilder:validation:XValidation:rule="self.type == 'namespacedRef' && has(self.namespacedRef) ? !has(self.namespacedRef.namespace) : true", message="cross namespace references are not supported for networkRef of type namespacedRef"
 	NetworkRef commonv1alpha1.ObjectRef `json:"networkRef"`
 
 	// Autoscale configuration for the data-plane group.

@@ -3847,7 +3847,7 @@ KonnectConfigurationDataPlaneGroup is the schema for the KonnectConfiguration ty
 | --- | --- |
 | `provider` _[ProviderName](#providername)_ | Name of cloud provider. |
 | `region` _string_ | Region for cloud provider region. |
-| `networkRef` _[ObjectRef](#objectref)_ | NetworkRef is the reference to the network that this data-plane group will be deployed on. |
+| `networkRef` _[ObjectRef](#objectref)_ | NetworkRef is the reference to the network that this data-plane group will be deployed on.<br /><br /> Cross namespace references are not supported for networkRef of type namespacedRef. This will be enforced in the future but currently (due to limitation in CEL validation in Kubernetes 1.31 and older) it is not. |
 | `autoscale` _[ConfigurationDataPlaneGroupAutoscale](#configurationdataplanegroupautoscale)_ | Autoscale configuration for the data-plane group. |
 | `environment` _[ConfigurationDataPlaneGroupEnvironmentField](#configurationdataplanegroupenvironmentfield) array_ | Array of environment variables to set for a data-plane group. |
 

@@ -489,7 +489,7 @@ KonnectConfigurationDataPlaneGroup is the schema for the KonnectConfiguration ty
 | --- | --- |
 | `provider` _[ProviderName](#providername)_ | Name of cloud provider. |
 | `region` _string_ | Region for cloud provider region. |
-| `networkRef` _[ObjectRef](#objectref)_ | NetworkRef is the reference to the network that this data-plane group will be deployed on. |
+| `networkRef` _[ObjectRef](#objectref)_ | NetworkRef is the reference to the network that this data-plane group will be deployed on.<br /><br /> Cross namespace references are not supported for networkRef of type namespacedRef. This will be enforced in the future but currently (due to limitation in CEL validation in Kubernetes 1.31 and older) it is not. |
 | `autoscale` _[ConfigurationDataPlaneGroupAutoscale](#configurationdataplanegroupautoscale)_ | Autoscale configuration for the data-plane group. |
 | `environment` _[ConfigurationDataPlaneGroupEnvironmentField](#configurationdataplanegroupenvironmentfield) array_ | Array of environment variables to set for a data-plane group. |
 

@@ -53,6 +53,9 @@ type TestCase[T client.Object] struct {
 	// Name is the name of the test case.
 	Name string
 
+	// SkipReason is the reason to skip the test case.
+	SkipReason string
+
 	// TestObject is the object to be tested.
 	TestObject T
 
@@ -73,6 +76,10 @@ type TestCase[T client.Object] struct {
 
 // RunWithConfig runs the test case against the provided rest.Config's cluster.
 func (tc *TestCase[T]) RunWithConfig(t *testing.T, cfg *rest.Config, scheme *runtime.Scheme) {
+	if tc.SkipReason != "" {
+		t.Skip(tc.SkipReason)
+	}
+
 	timeout := DefaultEventuallyTimeout
 	if tc.ExpectedErrorEventuallyConfig.Timeout != 0 {
 		timeout = tc.ExpectedErrorEventuallyConfig.Timeout

@@ -303,6 +303,9 @@ func TestKonnectDataPlaneGroupConfiguration(t *testing.T) {
 			},
 			{
 				Name: "networkRef namespacedRef cannot specify namespace",
+				SkipReason: "cross namespace references are not allowed but using the CEL reserved fields like 'namespace' " +
+					"is only allowed in Kubernetes 1.32+ (https://github.com/kubernetes/kubernetes/pull/126977). " +
+					"Re-enable this test and reintroduce the rule that enforces this when 1.32 becomes the oldest supported version.",
 				TestObject: &konnectv1alpha1.KonnectCloudGatewayDataPlaneGroupConfiguration{
 					ObjectMeta: common.CommonObjectMeta,
 					Spec: konnectv1alpha1.KonnectCloudGatewayDataPlaneGroupConfigurationSpec{

@@ -326,7 +326,13 @@ func TestKonnectExtension(t *testing.T) {
 						},
 					},
 				},
-				ExpectedErrorMessage: lo.ToPtr("Too long: may not be more than 63 bytes"),
+				// NOTE: Kubernetes 1.32 changed the validation error for values exceeding the maximum length.
+				// It used to be:
+				// "Too long: may not be longer than 63"
+				// In 1.32+ it is:
+				// "Too long: may not be more than 63 bytes"
+				// We're using here the common part of the error message to avoid breaking the test when upgrading Kubernetes.
+				ExpectedErrorMessage: lo.ToPtr("Too long: may not be "),
 			},
 			{
 				Name: "invalid label key 1",