Taming the Beast: The Move To Declarative API Validation in Kubernetes
summary
Kubernetes replaces ~19–15k lines of duplicated handwritten Go validation across ~20+ validation.go files with field-attached declarative tags parsed by the new validation-gen binary that emits zz_generated.go validator functions. A migration uses feature gates (declarativeValidation and declarativeValidationTakeover), runs generated and handwritten validators in parallel, compares errors to drive metrics toward zero, and supports ratcheting, cross-field checks, immutability and safe backward-compatible upgrades.
AI-written summary · about
chapters (15)
- 0:00Declarative API validation intro
- 1:51Imperative validation problems
- 2:55Vision for declarative validation
- 4:46Validation gen architecture
- 8:01Migration strategy and gates
- 13:21Migration phases and stability
- 16:54Call for contributors
- 19:32Q&A: Getting started
- 22:02Q&A: Tracking validation tags
- 24:10Q&A: CRD and type tags
- 27:08Q&A: CEL and CRD future
- 29:37Q&A: Balancing CEL
- 32:05Q&A: Feature gates
- 33:30Q&A: Update-only validations
- 36:23Closing remarks
related talks
29mEVAPorating Kubernetes Security Risk: Adopting Validating Admission Policy at Scale
38mOne Definition of Valid
37mDeveloper Tooling for Kubernetes Configuration
37mEdit, Debug, & Secure the K8s Manifest Lifecycle: Why is it Important and How Can You Get it Right?
36mSIG API Machinery Deep Dive
23mCRD Validation in Kubernetes
28mKubernetes CRD Design for the Long Haul: Tips, Tricks, and Lessons Learned
05mKubernetes API Explained