Azure / karpenter-provider-azure / 23363999456

94%

main: 94%

Pull #1553

github

feat: add kubernetes.azure.com validation rules synced from AKS RP

Add CRD-level CEL validation rules that block kubernetes.azure.com/*
labels and taints unless they are in an explicit allowlist, matching
the validation enforced by AKS RP's Machine API.

Previously, only the karpenter.azure.com/ domain was restricted in
CRDs. The kubernetes.azure.com/ domain was unrestricted, meaning users
could set system labels (e.g., node-image-version, ebpf-dataplane)
that would be rejected by Machine API at provisioning time.

The new approach:
- pkg/apis/validation/aksrules.go: Single source of truth defining
  which kubernetes.azure.com/* keys are allowed for user input
- hack/validation/cmd/gencel: Go tool that generates CEL expressions
  from the aksrules.go constants
- hack/validation/{labels,requirements,taints}.sh: Updated to generate
  both karpenter.azure.com and kubernetes.azure.com rules from code
- pkg/apis/validation/aksrules_sync_test.go: Snapshot tests that
  compare our rules against known AKS RP validation constants, with
  instructions on how to update when RP changes

Addresses: https://github.com/Azure/karpenter-poc/issues/1710

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

27 of 27 new or added lines in 1 file covered. (100.0%)

58854 of 62756 relevant lines covered (93.78%)

0.95 hits per line