Admission Control

// Implement this interface for each kind you want to validatetype Validator interface {    Validate(ctx context.Context, request *app.AdmissionRequest) error}

type MyKindValidator struct{}
func (v *MyKindValidator) Validate(ctx context.Context, req *app.AdmissionRequest) error {    obj, ok := req.Object.(*v1.MyKind)    if !ok {        return fmt.Errorf("admission request object was of invalid type %T (expected *v1.MyKind)", req.Object)    }
    // Validate spec fields    if obj.Spec.Title == "" {        return fmt.Errorf("spec.title is required")    }
    if obj.Spec.Count < 0 {        return fmt.Errorf("spec.count must be non-negative, got %d", obj.Spec.Count)    }
    // Distinguish create vs update    if req.Action == resource.AdmissionActionUpdate && req.OldObject != nil {        old, ok := req.OldObject.(*v1.MyKind)        if !ok {            return fmt.Errorf("admission request old object was of invalid type %T (expected *v1.MyKind)", req.OldObject)        }        if old.Spec.Title != obj.Spec.Title {            return fmt.Errorf("spec.title is immutable after creation")        }    }
    return nil}

// Implement this interface to mutate resources before persistencetype Mutator interface {    Mutate(ctx context.Context, request *app.AdmissionRequest) (*app.MutatingResponse, error)}

type MyKindMutator struct{}
func (m *MyKindMutator) Mutate(    ctx context.Context,    req *app.AdmissionRequest,) (*app.MutatingResponse, error) {    obj, ok := req.Object.(*v1.MyKind)    if !ok {        return nil, fmt.Errorf("admission request object was of invalid type %T (expected *v1.MyKind)", req.Object)    }
    // Set defaults on create    if req.Action == resource.AdmissionActionCreate {        if obj.Spec.Description == "" {            obj.Spec.Description = "No description provided"        }    }
    return &app.MutatingResponse{UpdatedObject: obj}, nil}

func New(cfg app.Config) (app.App, error) {    cfg.KubeConfig.APIPath = "/apis"    a, err := simple.NewApp(simple.AppConfig{        ManagedKinds: []simple.AppManagedKind{            {                Kind:      v1.MyKindKind(),                Validator: &MyKindValidator{},                Mutator:   &MyKindMutator{},            },        },    })    if err != nil {      return nil, fmt.Errorf("error creating app: %w", err)    }    if err = a.ValidateManifest(cfg.ManifestData); err != nil {        return nil, fmt.Errorf("app manifest validation failed: %w", err)    }    return a, nil}

// Immutability checkif req.Action == resource.AdmissionActionUpdate && old.Spec.ImmutableField != obj.Spec.ImmutableField {    return fmt.Errorf("spec.immutableField cannot be changed after creation")}
// Cross-field validationif obj.Spec.StartTime.After(obj.Spec.EndTime) {    return fmt.Errorf("spec.startTime must be before spec.endTime")}
// Referential validation (e.g. check referenced resource exists)if _, err := v.client.Get(ctx, resource.Identifier{Name: obj.Spec.RefName, Namespace: obj.Namespace}); err != nil {    return fmt.Errorf("referenced resource %q not found", obj.Spec.RefName)}