Ability to explicit additionalProperties on CustomResource generated schemas

[jeremylvln]

It seems that when generating the CRD YAML with kube-derive, all structs do not have a additionalProperties property defined on their schemas. This allows anyone to inject any data (that will not be used, but still accepted by Kubernetes's APIs).

Is there any mechanism to define this value ourselves? Should this be the default to not accept any unknown value?

[clux]

Great question. I would like to know a good answer to this myself.

It is possible that this could be circumvented in another way with field pruning (setting this bool), but i'm not sure it works the correct way.

[jeremylvln]

I looked a controller-gen, the tool widely used in the Go ecosystem for generating CRDs. They do not set this property either: https://github.com/kubernetes-sigs/controller-tools/blob/master/pkg/crd/schema.go#L335.

Field pruning is nice because the API server will not save unknown properties, however it would be nicer if they weren't accepted in a first place, don't you think? I just had this problem in my project where someone opened an issue because of something didn't work, but it just wasn't existing - still the validation passed.

I think the behavior should match controller-gen's one, so not setting additionalProperties explicitly. But I think we should have a way of defining it ourselves (a derive macro maybe?)

[clux]

it would be nicer if they weren't accepted in a first place, don't you think?

yeah in theory. i am just a bit scared of messing with schema properties because of how finicky and subtle it all is as it has bitten us before (and am a bit short for time to dive deeply into this now).

some context that might be helpful;

• https://docs.rs/kube/latest/kube/core/schema/struct.StructuralSchemaRewriter.html and linked issues
• https://github.com/kube-rs/kube/blob/main/kube-core/src/schema.rs