Validation webhook implementation #1682

patrykw-splunk · 2026-02-02T17:28:53Z

Description

Implements an opt-in validation webhook for Splunk Enterprise CRDs that validates spec fields on CREATE and UPDATE operations, providing immediate feedback when invalid configurations are submitted.

The webhook is disabled by default and can be enabled by setting ENABLE_WEBHOOKS=true or using the config/default-with-webhook kustomize overlay.

Key Changes

New Validation Package (`pkg/splunk/enterprise/validation/`)

Validator framework - Generic type-safe validator using Go generics
Webhook server - HTTP server with TLS support on port 9443
CRD validators - Standalone, IndexerCluster, SearchHeadCluster, ClusterManager, LicenseManager, MonitoringConsole

Validated Fields

Field	Rule
`spec.replicas`	≥ 0 (Standalone), ≥ 3 (IndexerCluster, SearchHeadCluster)
`spec.imagePullPolicy`	Must be `Always`, `Never`, or `IfNotPresent`
`spec.livenessInitialDelaySeconds`	≥ 3
`spec.readinessInitialDelaySeconds`	≥ 3
`spec.etcVolumeStorageConfig.storageCapacity`	Format `^[0-9]+Gi$`
`spec.varVolumeStorageConfig.storageCapacity`	Format `^[0-9]+Gi$`
`spec.smartstore`	Volume/index name validation (conditional)
`spec.appRepo`	App source name/location validation (conditional)

Webhook Infrastructure

config/webhook/ - Service and ValidatingWebhookConfiguration
config/certmanager/ - TLS certificate via cert-manager
config/default-with-webhook/ - Opt-in kustomize overlay

Documentation

docs/ValidationWebhook.md

Testing and Verification

Comprehensive unit tests (~95% coverage)
Server and HTTP handler tests

Related Issues

N/A

PR Checklist

Code changes adhere to the project's coding standards.
Relevant unit and integration tests are included.
Documentation has been updated accordingly.
All tests pass locally.
The PR description follows the project's guidelines.

* implementation of dummy validation webhook --------- Co-authored-by: Patryk Wasielewski <pwasiele@splunk.com>

Implement Validation Webhook logic + unit tests + mux server for webhook --------- Co-authored-by: Patryk Wasielewski <pwasiele@splunk.com>

github-actions · 2026-02-02T17:29:06Z

CLA Assistant Lite bot:
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

I have read the CLA Document and I hereby sign the CLA

0 out of 2 committers have signed the CLA.
❌ @patrykw-splunk
❌ @patryk Wasielewski
Patryk Wasielewski seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request}

coveralls · 2026-02-02T17:39:58Z

Pull Request Test Coverage Report for Build 21636244635

Details

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage increased (+0.02%) to 86.242%

Totals
Change from base Build 21471999380:	0.02%
Covered Lines:	10763
Relevant Lines:	12480

💛 - Coveralls

patrykw-splunk · 2026-02-02T18:41:02Z

docs/ValidationWebhook.md

+
+The webhook validates the following Custom Resource Definitions:
+
+- Standalone


add here bias language CRDs

kasiakoziol · 2026-02-03T08:05:33Z

config/webhook/manifests.yaml

+    - indexerclusters
+    - searchheadclusters
+    - clustermanagers
+    - clustermasters


If we are doing it only for v4, then I guess any references to ClusterMaster or LicenseMaster in this file and others could be removed.

I think it is slightly inconsistent across different files, so we have to decide on the approach.

the difference is that here it's necessary to list here all resources for validation sake

kasiakoziol · 2026-02-03T08:06:14Z

pkg/splunk/enterprise/validation/clustermanager_validation.go

+func ValidateClusterManagerUpdate(obj, oldObj *enterpriseApi.ClusterManager) field.ErrorList {
+	var allErrs field.ErrorList
+	allErrs = append(allErrs, ValidateClusterManagerCreate(obj)...)
+	return allErrs


Could it be just a one line instead of three?

This comment applies to all such functions

This is a topic for discussion. One liner could fit here ideally if we would know that this function won't be extended. The problem is that if we want to add i.e immutable fields (and we're planning to) this will look like it

example

`// ValidateClusterManagerUpdate validates a ClusterManager on UPDATE
func ValidateClusterManagerUpdate(obj, oldObj *enterpriseApi.ClusterManager) field.ErrorList {
allErrs := ValidateClusterManagerCreate(obj)

// Example: Check immutable fields // Example 1: Prevent changing ClusterManagerRef (if it was set) if oldObj.Spec.ClusterManagerRef.Name != "" && obj.Spec.ClusterManagerRef.Name != oldObj.Spec.ClusterManagerRef.Name { allErrs = append(allErrs, field.Forbidden( field.NewPath("spec").Child("clusterManagerRef").Child("name"), "field is immutable once set")) }

`

And what if not? 😄 I get your point.

kasiakoziol · 2026-02-03T08:06:55Z

pkg/splunk/enterprise/validation/clustermanager_validation.go

+func GetClusterManagerWarningsOnCreate(obj *enterpriseApi.ClusterManager) []string {
+	var warnings []string
+	warnings = append(warnings, getCommonWarnings(&obj.Spec.CommonSplunkSpec)...)
+	return warnings


kasiakoziol · 2026-02-03T08:11:22Z

pkg/splunk/enterprise/validation/clustermanager_validation_test.go

+
+	warnings := GetClusterManagerWarningsOnCreate(obj)
+	if len(warnings) != 0 {
+		t.Errorf("GetClusterManagerWarningsOnCreate() returned %d warnings, expected 0", len(warnings))


Why don't we just use assertions?

It applies to all tests

kasiakoziol · 2026-02-03T08:14:48Z

pkg/splunk/enterprise/validation/common_validation.go

+func getCommonWarnings(spec *enterpriseApi.CommonSplunkSpec) []string {
+	var warnings []string
+
+	// Warn about deprecated fields or configurations


It's for the future sake, right?

kasiakoziol · 2026-02-03T08:21:56Z

pkg/splunk/enterprise/validation/indexercluster_validation_test.go

+			name: "invalid indexer cluster - zero replicas",
+			obj: &enterpriseApi.IndexerCluster{
+				Spec: enterpriseApi.IndexerClusterSpec{
+					Replicas: 0,


I think we are setting up replicas to 3 if not provided (in the controller code), so maybe we should add default value at the spec level if we are introducing webhooks to make sure we are backward compatible in case someone didn't provide the value.

It applies to all such cases

patrykw-splunk · 2026-02-03T13:20:47Z

I have read the Code of Conduct and I hereby accept the Terms

patrykw-splunk and others added 4 commits February 2, 2026 16:24

[Draft] Validation Webhook for splunk-operator (#1664)

83bde6d

* implementation of dummy validation webhook --------- Co-authored-by: Patryk Wasielewski <pwasiele@splunk.com>

Implement Validation Webhook for Splunk Enterprise CRDs (#1681)

eaed932

Implement Validation Webhook logic + unit tests + mux server for webhook --------- Co-authored-by: Patryk Wasielewski <pwasiele@splunk.com>

docs + opt in config for webhook

d5758bf

fix kustomize

fc21f5c

patrykw-splunk commented Feb 2, 2026

View reviewed changes

kasiakoziol reviewed Feb 3, 2026

View reviewed changes

kasiakoziol approved these changes Feb 3, 2026

View reviewed changes

update docs

d674a50


		The webhook validates the following Custom Resource Definitions:

		- Standalone

Validation webhook implementation #1682

Are you sure you want to change the base?

Validation webhook implementation #1682

Conversation

patrykw-splunk commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Key Changes

New Validation Package (pkg/splunk/enterprise/validation/)

Validated Fields

Webhook Infrastructure

Documentation

Testing and Verification

Related Issues

PR Checklist

Uh oh!

github-actions bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coveralls commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 21636244635

Details

💛 - Coveralls

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kasiakoziol Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

patrykw-splunk commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

patrykw-splunk commented Feb 2, 2026 •

edited

Loading

New Validation Package (`pkg/splunk/enterprise/validation/`)

github-actions bot commented Feb 2, 2026 •

edited

Loading

coveralls commented Feb 2, 2026 •

edited

Loading

kasiakoziol Feb 3, 2026 •

edited

Loading