From cd3618e8deb4c842e0e5351966510c8c70960fc0 Mon Sep 17 00:00:00 2001 From: Tim Hockin Date: Tue, 1 Sep 2026 16:30:11 -0700 Subject: [PATCH 1/2] Move custom validation to SnapshotsConfig type --- cmd/ateapi/internal/controlapi/actor_template.go | 4 ++-- .../internal/controlapi/zz_generated.validation.go | 9 +++++---- pkg/proto/ateapipb/ateapi.pb.go | 2 +- pkg/proto/ateapipb/ateapi.proto | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/cmd/ateapi/internal/controlapi/actor_template.go b/cmd/ateapi/internal/controlapi/actor_template.go index 81f69089dd..87a08d89f2 100644 --- a/cmd/ateapi/internal/controlapi/actor_template.go +++ b/cmd/ateapi/internal/controlapi/actor_template.go @@ -270,10 +270,10 @@ func ValidateCustom_Resources_Limits(_ context.Context, _ operation.Operation, f return errs } -// ValidateCustom_ActorTemplate_SnapshotsConfig mirrors the ActorTemplate +// ValidateCustom_SnapshotsConfig mirrors the ActorTemplate // CRD's CEL rule: on_commit must be a subset of on_pause. UNSPECIFIED means // FULL, so an unset on_commit over a DATA on_pause is rejected too. -func ValidateCustom_ActorTemplate_SnapshotsConfig(_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *ateapipb.SnapshotsConfig) field.ErrorList { +func ValidateCustom_SnapshotsConfig(_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *ateapipb.SnapshotsConfig) field.ErrorList { if value.GetOnPause() == ateapipb.SnapshotContentScope_SNAPSHOT_CONTENT_SCOPE_DATA && value.GetOnCommit() != ateapipb.SnapshotContentScope_SNAPSHOT_CONTENT_SCOPE_DATA { return field.ErrorList{field.Invalid(fldPath.Child("on_commit"), value.GetOnCommit().String(), "must be a subset of on_pause")} diff --git a/cmd/ateapi/internal/controlapi/zz_generated.validation.go b/cmd/ateapi/internal/controlapi/zz_generated.validation.go index 825a603652..96ecbc8af7 100644 --- a/cmd/ateapi/internal/controlapi/zz_generated.validation.go +++ b/cmd/ateapi/internal/controlapi/zz_generated.validation.go @@ -1122,10 +1122,6 @@ func Validate_ActorTemplate( if earlyReturn { return // do not proceed } - // custom validation - if e := ValidateCustom_ActorTemplate_SnapshotsConfig(ctx, op, fldPath, obj, oldObj); len(e) != 0 { - errs = append(errs, e...) - } // call the type's validation function errs = append(errs, Validate_SnapshotsConfig(ctx, op, fldPath, obj, oldObj)...) return @@ -5344,6 +5340,11 @@ func Validate_SnapshotsConfig( ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ateapipb.SnapshotsConfig) (errs field.ErrorList) { + // custom validation + if e := ValidateCustom_SnapshotsConfig(ctx, op, fldPath, obj, oldObj); len(e) != 0 { + errs = append(errs, e...) + } + { // field ateapipb.SnapshotsConfig.OnPause fn := func( fldPath *field.Path, diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index fd5cd3ba1b..dae99ca794 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -2107,7 +2107,6 @@ type ActorTemplate struct { // +k8s:listMapKey=name Volumes []*Volume `protobuf:"bytes,4,rep,name=volumes,proto3" json:"volumes,omitempty"` // +k8s:required - // +k8s:customValidation # on_commit must be a subset of on_pause SnapshotsConfig *SnapshotsConfig `protobuf:"bytes,5,opt,name=snapshots_config,json=snapshotsConfig,proto3" json:"snapshots_config,omitempty"` // sandbox_config selects the sandbox runtime this version's actors run on. // @@ -2494,6 +2493,7 @@ func (x *SandboxConfig) GetConfigName() string { return "" } +// +k8s:customValidation # on_commit must be a subset of on_pause type SnapshotsConfig struct { state protoimpl.MessageState `protogen:"open.v1"` // on_pause selects what is captured during pause actor. UNSPECIFIED is diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index 038f76fe93..861dba3928 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -730,7 +730,6 @@ message ActorTemplate { repeated Volume volumes = 4; // +k8s:required - // +k8s:customValidation # on_commit must be a subset of on_pause SnapshotsConfig snapshots_config = 5; // sandbox_config selects the sandbox runtime this version's actors run on. @@ -808,6 +807,7 @@ message SandboxConfig { string config_name = 2; } +// +k8s:customValidation # on_commit must be a subset of on_pause message SnapshotsConfig { // on_pause selects what is captured during pause actor. UNSPECIFIED is // tolerated for compatibility and reads as FULL. From 33e9b1c666ac8316a95cf4770a7fb6c75c3a8b69 Mon Sep 17 00:00:00 2001 From: Tim Hockin Date: Tue, 1 Sep 2026 17:18:36 -0700 Subject: [PATCH 2/2] Add a comment on env-var expansion --- pkg/proto/ateapipb/ateapi.pb.go | 3 +++ pkg/proto/ateapipb/ateapi.proto | 3 +++ 2 files changed, 6 insertions(+) diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index dae99ca794..d5aedfa4c3 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -2665,6 +2665,9 @@ type Container struct { // +k8s:listType=atomic // +k8s:eachVal=+k8s:maxLength=4096 # argv strings; guardrail, not a contract Args []string `protobuf:"bytes,4,rep,name=args,proto3" json:"args,omitempty"` + // Env variables to set in the container's process environment. Unlike + // Kubernetes, $(VAR_NAME) references are NOT expanded in this field. + // // +k8s:optional // +k8s:maxItems=32 // +k8s:listType=map # each variable is set at most once diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index 861dba3928..e155c624f1 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -897,6 +897,9 @@ message Container { // +k8s:eachVal=+k8s:maxLength=4096 # argv strings; guardrail, not a contract repeated string args = 4; + // Env variables to set in the container's process environment. Unlike + // Kubernetes, $(VAR_NAME) references are NOT expanded in this field. + // // +k8s:optional // +k8s:maxItems=32 // +k8s:listType=map # each variable is set at most once