Struct Validator 

pub struct Validator { /* private fields */ }

Available on crate feature validation only.

Validates Kubernetes objects against CRD schema CEL validation rules.

Walks the OpenAPI schema tree, compiles x-kubernetes-validations rules at each node, and evaluates them against the corresponding object values.

For repeated validation against the same schema, use compile_schema + validate_compiled to avoid re-compilation.

Thread Safety

Validator is Send and can be moved across threads.

Implementations

impl Validator

pub fn new() -> Self

Create a new Validator with all K8s CEL functions pre-registered.

Examples found in repository

examples/message_expression.rs (line 35)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "spec": {
                "type": "object",
                "properties": {
                    "replicas": {"type": "integer"}
                },
                "x-kubernetes-validations": [{
                    "rule": "self.replicas <= 5",
                    // Static fallback, used if messageExpression is absent/non-string.
                    "message": "too many replicas",
                    // Dynamic message: embeds the actual value and the limit.
                    "messageExpression":
                        "'requested ' + string(self.replicas) + ' replicas, max allowed is 5'"
                }]
            }
        }
    });

    let validator = Validator::new();

    // Two invalid objects: the dynamic message differs per object.
    for replicas in [8, 20] {
        let object = json!({"spec": {"replicas": replicas}});
        let errors = validator.validate(&schema, &object, None);
        for err in &errors {
            // Note the message reflects this object's value, not a fixed string.
            println!("replicas={replicas}: {}", err.message);
        }
    }

    // A valid object produces no errors (and so no message at all).
    let ok = json!({"spec": {"replicas": 3}});
    println!(
        "replicas=3: {} error(s)",
        validator.validate(&schema, &ok, None).len()
    );
}

examples/transition_rules.rs (line 38)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "storageClass": {"type": "string"},
            "replicas": {"type": "integer"}
        },
        "x-kubernetes-validations": [
            // Immutable field: may never change once set.
            {
                "rule": "self.storageClass == oldSelf.storageClass",
                "message": "storageClass is immutable"
            },
            // Monotonic: replicas may only grow (no scale-down).
            {
                "rule": "self.replicas >= oldSelf.replicas",
                "message": "replicas cannot be decreased"
            }
        ]
    });

    let validator = Validator::new();
    let stored = json!({"storageClass": "fast-ssd", "replicas": 3});

    // CREATE: no previous state, so transition rules are skipped entirely.
    let created = json!({"storageClass": "fast-ssd", "replicas": 3});
    report("CREATE (old = None)", validator.validate(&schema, &created, None));

    // UPDATE that respects both rules: same storageClass, scaling up.
    let scale_up = json!({"storageClass": "fast-ssd", "replicas": 5});
    report(
        "UPDATE scale up 3->5",
        validator.validate(&schema, &scale_up, Some(&stored)),
    );

    // UPDATE that violates the monotonic rule: scaling down.
    let scale_down = json!({"storageClass": "fast-ssd", "replicas": 1});
    report(
        "UPDATE scale down 3->1",
        validator.validate(&schema, &scale_down, Some(&stored)),
    );

    // UPDATE that mutates an immutable field.
    let restorage = json!({"storageClass": "cheap-hdd", "replicas": 3});
    report(
        "UPDATE change storageClass",
        validator.validate(&schema, &restorage, Some(&stored)),
    );
}

examples/validate_crd.rs (line 29)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "spec": {
                "type": "object",
                "properties": {
                    "replicas": {
                        "type": "integer",
                        "x-kubernetes-validations": [
                            {"rule": "self >= 0", "message": "replicas must be non-negative"}
                        ]
                    }
                },
                "x-kubernetes-validations": [
                    {"rule": "self.replicas >= 1", "message": "at least one replica required"}
                ]
            }
        }
    });

    let validator = Validator::new();

    // Valid object
    let valid = json!({"spec": {"replicas": 3}});
    let errors = validator.validate(&schema, &valid, None);
    println!("Valid object: {} errors", errors.len());

    // Invalid object
    let invalid = json!({"spec": {"replicas": -1}});
    let errors = validator.validate(&schema, &invalid, None);
    println!("\nInvalid object: {} errors", errors.len());
    for err in &errors {
        println!("  [{path}] {msg}", path = err.field_path, msg = err.message);
    }

    // Transition rule (update check)
    let transition_schema = json!({
        "type": "object",
        "x-kubernetes-validations": [{
            "rule": "self.replicas >= oldSelf.replicas",
            "message": "cannot scale down"
        }],
        "properties": {
            "replicas": {"type": "integer"}
        }
    });

    let new_obj = json!({"replicas": 2});
    let old_obj = json!({"replicas": 5});

    // Create (no old object): transition rule skipped
    let errors = validator.validate(&transition_schema, &new_obj, None);
    println!("\nCreate (no old): {} errors", errors.len());

    // Update (scale down): transition rule fires
    let errors = validator.validate(&transition_schema, &new_obj, Some(&old_obj));
    println!("Update (scale down): {} errors", errors.len());
    for err in &errors {
        println!("  {}", err);
    }
}

examples/kube_workflow.rs (line 29)

fn main() {
    // In a real controller this comes from the cluster, e.g.:
    //     use kube::{Api, Client};
    //     use k8s_openapi::apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition;
    //     let crds: Api<CustomResourceDefinition> = Api::all(client);
    //     let crd = crds.get("widgets.example.com").await?;
    //     let schema = crd.spec.versions[0].schema.unwrap().open_api_v3_schema.unwrap();
    // Here we mock that fetched OpenAPI v3 schema directly.
    let schema = fetch_crd_schema();

    let validator = Validator::new();

    // A controller reconcile loop typically builds a *desired* object and applies
    // it. We show two desired states: one valid, one that violates the CRD rules.
    let desired_ok = json!({
        "spec": { "replicas": 3, "image": "registry.example.com/widget:1.4.2" }
    });
    let desired_bad = json!({
        "spec": { "replicas": 0, "image": "widget:latest" }
    });

    for (label, desired) in [("valid desired", &desired_ok), ("invalid desired", &desired_bad)] {
        println!("=== reconcile: {label} ===");

        // Client-side gate, run BEFORE touching the apiserver.
        let errors = validator.validate(&schema, desired, None);

        if errors.is_empty() {
            println!("  validation passed -> apply to cluster");
            // The real apply happens only on the happy path:
            //     let widgets: Api<Widget> = Api::namespaced(client, "default");
            //     widgets.patch("my-widget", &PatchParams::apply("my-controller"),
            //                   &Patch::Apply(desired)).await?;
        } else {
            println!("  validation failed -> skip apply, record on status:");
            for err in &errors {
                println!("    [{}] {}", err.field_path, err.message);
            }
            // Instead of a doomed apply, the controller would surface the reason:
            //     widgets.patch_status("my-widget", &pp,
            //         &Patch::Merge(json!({"status": {"validationError": err.message}}))).await?;
        }
        println!();
    }
}

examples/error_chain.rs (line 39)

fn main() {
    // Three rules, each failing a different way against the same object.
    let schema = json!({
        "type": "object",
        "x-kubernetes-validations": [
            // (1) the object simply violates the rule -> ValidationFailure
            {"rule": "self.replicas >= 1", "message": "replicas must be at least 1"},
            // (2) the rule references a field that isn't there -> EvaluationError
            //     (compiles fine, errors at runtime; the cel error is the cause)
            {"rule": "self.maxSurge > 0", "message": "maxSurge must be positive"},
            // (3) the rule uses a CEL macro cel 0.13 can't evaluate -> UnsupportedReference
            {"rule": "self.zones.sortBy(z, z) == self.zones", "message": "zones must be sorted"}
        ],
        "properties": {
            "replicas": {"type": "integer"},
            "zones": {"type": "array", "items": {"type": "string"}}
        }
    });

    let object = json!({"replicas": 0, "zones": ["b", "a"]});

    let errors = Validator::new().validate(&schema, &object, None);

    println!("{} validation error(s)\n", errors.len());
    for err in &errors {
        println!("rule: {}", err.rule);
        println!("  kind: {:?}", err.kind);
        println!("  message: {err}");

        // Branch on the classification. `ErrorKind` is `#[non_exhaustive]`, so a
        // wildcard arm is required.
        match err.kind {
            ErrorKind::ValidationFailure => {
                println!("  -> the object violated the rule; reject it");
            }
            ErrorKind::EvaluationError => {
                println!("  -> the rule failed at runtime; likely a malformed object");
            }
            ErrorKind::UnsupportedReference => {
                println!("  -> coverage gap: this kube-cel build can't evaluate the rule");
            }
            _ => println!("  -> other ({:?})", err.kind),
        }

        // Walk the `source()` cause chain. Runtime failures carry the owned `cel`
        // execution error as their cause; pure ValidationFailure has none.
        let mut cause = err.source();
        if cause.is_none() {
            println!("  (no underlying cause)");
        }
        let mut depth = 1;
        while let Some(e) = cause {
            println!("  {:indent$}caused by: {e}", "", indent = depth * 2);
            cause = e.source();
            depth += 1;
        }
        println!();
    }
}

examples/defaults_and_context.rs (line 46)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        },
        "x-kubernetes-validations": [
            {"rule": "apiGroup == 'apps'", "message": "only apps group allowed"},
            {"rule": "kind == 'Deployment'", "message": "must be a Deployment"}
        ]
    });

    // Object with missing fields (would have defaults in K8s)
    let object = json!({"replicas": 3});

    // 1. Apply defaults
    let defaulted = apply_defaults(&schema, &object);
    println!("=== Default Injection ===");
    println!("Before: {object}");
    println!("After:  {defaulted}\n");

    // 2. Validate with root context
    let root_ctx = RootContext {
        api_version: "apps/v1".into(),
        api_group: "apps".into(),
        kind: "Deployment".into(),
    };

    let validator = Validator::new();
    let errors = validator.validate_with_context(&schema, &defaulted, None, Some(&root_ctx));

    println!("=== Validation Results ===");
    if errors.is_empty() {
        println!("All rules passed!");
    } else {
        for e in &errors {
            println!("[FAIL] {}: {}", e.field_path, e.message);
        }
    }

    // 3. Demonstrate validate_with_defaults convenience method
    // Uses a simpler schema without root-context variables (apiGroup/kind),
    // since validate_with_defaults does not accept a RootContext.
    println!("\n=== validate_with_defaults ===");
    let simple_schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        }
    });
    let sparse_object = json!({}); // no fields at all
    let errors = validator.validate_with_defaults(&simple_schema, &sparse_object, None);
    println!("Validating empty object with defaults applied:");
    if errors.is_empty() {
        println!("All rules passed (replicas defaulted to 1, strategy to RollingUpdate)");
    } else {
        for e in &errors {
            println!("[FAIL] {}", e.message);
        }
    }
}

pub fn validate( &self, schema: &Value, object: &Value, old_object: Option<&Value>, ) -> Vec<ValidationError>

Validate an object against a CRD schema’s CEL validation rules.

Compiles rules on each call. For repeated validation against the same schema, prefer compile_schema + validate_compiled.

Examples found in repository

examples/message_expression.rs (line 40)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "spec": {
                "type": "object",
                "properties": {
                    "replicas": {"type": "integer"}
                },
                "x-kubernetes-validations": [{
                    "rule": "self.replicas <= 5",
                    // Static fallback, used if messageExpression is absent/non-string.
                    "message": "too many replicas",
                    // Dynamic message: embeds the actual value and the limit.
                    "messageExpression":
                        "'requested ' + string(self.replicas) + ' replicas, max allowed is 5'"
                }]
            }
        }
    });

    let validator = Validator::new();

    // Two invalid objects: the dynamic message differs per object.
    for replicas in [8, 20] {
        let object = json!({"spec": {"replicas": replicas}});
        let errors = validator.validate(&schema, &object, None);
        for err in &errors {
            // Note the message reflects this object's value, not a fixed string.
            println!("replicas={replicas}: {}", err.message);
        }
    }

    // A valid object produces no errors (and so no message at all).
    let ok = json!({"spec": {"replicas": 3}});
    println!(
        "replicas=3: {} error(s)",
        validator.validate(&schema, &ok, None).len()
    );
}

examples/transition_rules.rs (line 43)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "storageClass": {"type": "string"},
            "replicas": {"type": "integer"}
        },
        "x-kubernetes-validations": [
            // Immutable field: may never change once set.
            {
                "rule": "self.storageClass == oldSelf.storageClass",
                "message": "storageClass is immutable"
            },
            // Monotonic: replicas may only grow (no scale-down).
            {
                "rule": "self.replicas >= oldSelf.replicas",
                "message": "replicas cannot be decreased"
            }
        ]
    });

    let validator = Validator::new();
    let stored = json!({"storageClass": "fast-ssd", "replicas": 3});

    // CREATE: no previous state, so transition rules are skipped entirely.
    let created = json!({"storageClass": "fast-ssd", "replicas": 3});
    report("CREATE (old = None)", validator.validate(&schema, &created, None));

    // UPDATE that respects both rules: same storageClass, scaling up.
    let scale_up = json!({"storageClass": "fast-ssd", "replicas": 5});
    report(
        "UPDATE scale up 3->5",
        validator.validate(&schema, &scale_up, Some(&stored)),
    );

    // UPDATE that violates the monotonic rule: scaling down.
    let scale_down = json!({"storageClass": "fast-ssd", "replicas": 1});
    report(
        "UPDATE scale down 3->1",
        validator.validate(&schema, &scale_down, Some(&stored)),
    );

    // UPDATE that mutates an immutable field.
    let restorage = json!({"storageClass": "cheap-hdd", "replicas": 3});
    report(
        "UPDATE change storageClass",
        validator.validate(&schema, &restorage, Some(&stored)),
    );
}

examples/validate_crd.rs (line 33)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "spec": {
                "type": "object",
                "properties": {
                    "replicas": {
                        "type": "integer",
                        "x-kubernetes-validations": [
                            {"rule": "self >= 0", "message": "replicas must be non-negative"}
                        ]
                    }
                },
                "x-kubernetes-validations": [
                    {"rule": "self.replicas >= 1", "message": "at least one replica required"}
                ]
            }
        }
    });

    let validator = Validator::new();

    // Valid object
    let valid = json!({"spec": {"replicas": 3}});
    let errors = validator.validate(&schema, &valid, None);
    println!("Valid object: {} errors", errors.len());

    // Invalid object
    let invalid = json!({"spec": {"replicas": -1}});
    let errors = validator.validate(&schema, &invalid, None);
    println!("\nInvalid object: {} errors", errors.len());
    for err in &errors {
        println!("  [{path}] {msg}", path = err.field_path, msg = err.message);
    }

    // Transition rule (update check)
    let transition_schema = json!({
        "type": "object",
        "x-kubernetes-validations": [{
            "rule": "self.replicas >= oldSelf.replicas",
            "message": "cannot scale down"
        }],
        "properties": {
            "replicas": {"type": "integer"}
        }
    });

    let new_obj = json!({"replicas": 2});
    let old_obj = json!({"replicas": 5});

    // Create (no old object): transition rule skipped
    let errors = validator.validate(&transition_schema, &new_obj, None);
    println!("\nCreate (no old): {} errors", errors.len());

    // Update (scale down): transition rule fires
    let errors = validator.validate(&transition_schema, &new_obj, Some(&old_obj));
    println!("Update (scale down): {} errors", errors.len());
    for err in &errors {
        println!("  {}", err);
    }
}

examples/kube_workflow.rs (line 44)

fn main() {
    // In a real controller this comes from the cluster, e.g.:
    //     use kube::{Api, Client};
    //     use k8s_openapi::apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition;
    //     let crds: Api<CustomResourceDefinition> = Api::all(client);
    //     let crd = crds.get("widgets.example.com").await?;
    //     let schema = crd.spec.versions[0].schema.unwrap().open_api_v3_schema.unwrap();
    // Here we mock that fetched OpenAPI v3 schema directly.
    let schema = fetch_crd_schema();

    let validator = Validator::new();

    // A controller reconcile loop typically builds a *desired* object and applies
    // it. We show two desired states: one valid, one that violates the CRD rules.
    let desired_ok = json!({
        "spec": { "replicas": 3, "image": "registry.example.com/widget:1.4.2" }
    });
    let desired_bad = json!({
        "spec": { "replicas": 0, "image": "widget:latest" }
    });

    for (label, desired) in [("valid desired", &desired_ok), ("invalid desired", &desired_bad)] {
        println!("=== reconcile: {label} ===");

        // Client-side gate, run BEFORE touching the apiserver.
        let errors = validator.validate(&schema, desired, None);

        if errors.is_empty() {
            println!("  validation passed -> apply to cluster");
            // The real apply happens only on the happy path:
            //     let widgets: Api<Widget> = Api::namespaced(client, "default");
            //     widgets.patch("my-widget", &PatchParams::apply("my-controller"),
            //                   &Patch::Apply(desired)).await?;
        } else {
            println!("  validation failed -> skip apply, record on status:");
            for err in &errors {
                println!("    [{}] {}", err.field_path, err.message);
            }
            // Instead of a doomed apply, the controller would surface the reason:
            //     widgets.patch_status("my-widget", &pp,
            //         &Patch::Merge(json!({"status": {"validationError": err.message}}))).await?;
        }
        println!();
    }
}

examples/error_chain.rs (line 39)

fn main() {
    // Three rules, each failing a different way against the same object.
    let schema = json!({
        "type": "object",
        "x-kubernetes-validations": [
            // (1) the object simply violates the rule -> ValidationFailure
            {"rule": "self.replicas >= 1", "message": "replicas must be at least 1"},
            // (2) the rule references a field that isn't there -> EvaluationError
            //     (compiles fine, errors at runtime; the cel error is the cause)
            {"rule": "self.maxSurge > 0", "message": "maxSurge must be positive"},
            // (3) the rule uses a CEL macro cel 0.13 can't evaluate -> UnsupportedReference
            {"rule": "self.zones.sortBy(z, z) == self.zones", "message": "zones must be sorted"}
        ],
        "properties": {
            "replicas": {"type": "integer"},
            "zones": {"type": "array", "items": {"type": "string"}}
        }
    });

    let object = json!({"replicas": 0, "zones": ["b", "a"]});

    let errors = Validator::new().validate(&schema, &object, None);

    println!("{} validation error(s)\n", errors.len());
    for err in &errors {
        println!("rule: {}", err.rule);
        println!("  kind: {:?}", err.kind);
        println!("  message: {err}");

        // Branch on the classification. `ErrorKind` is `#[non_exhaustive]`, so a
        // wildcard arm is required.
        match err.kind {
            ErrorKind::ValidationFailure => {
                println!("  -> the object violated the rule; reject it");
            }
            ErrorKind::EvaluationError => {
                println!("  -> the rule failed at runtime; likely a malformed object");
            }
            ErrorKind::UnsupportedReference => {
                println!("  -> coverage gap: this kube-cel build can't evaluate the rule");
            }
            _ => println!("  -> other ({:?})", err.kind),
        }

        // Walk the `source()` cause chain. Runtime failures carry the owned `cel`
        // execution error as their cause; pure ValidationFailure has none.
        let mut cause = err.source();
        if cause.is_none() {
            println!("  (no underlying cause)");
        }
        let mut depth = 1;
        while let Some(e) = cause {
            println!("  {:indent$}caused by: {e}", "", indent = depth * 2);
            cause = e.source();
            depth += 1;
        }
        println!();
    }
}

pub fn validate_with_context( &self, schema: &Value, object: &Value, old_object: Option<&Value>, root_ctx: Option<&RootContext>, ) -> Vec<ValidationError>

Validate an object against a CRD schema’s CEL validation rules, with optional root context.

Like validate, but also binds apiVersion, apiGroup, and kind as root-level CEL variables when a RootContext is provided.

Examples found in repository

examples/defaults_and_context.rs (line 47)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        },
        "x-kubernetes-validations": [
            {"rule": "apiGroup == 'apps'", "message": "only apps group allowed"},
            {"rule": "kind == 'Deployment'", "message": "must be a Deployment"}
        ]
    });

    // Object with missing fields (would have defaults in K8s)
    let object = json!({"replicas": 3});

    // 1. Apply defaults
    let defaulted = apply_defaults(&schema, &object);
    println!("=== Default Injection ===");
    println!("Before: {object}");
    println!("After:  {defaulted}\n");

    // 2. Validate with root context
    let root_ctx = RootContext {
        api_version: "apps/v1".into(),
        api_group: "apps".into(),
        kind: "Deployment".into(),
    };

    let validator = Validator::new();
    let errors = validator.validate_with_context(&schema, &defaulted, None, Some(&root_ctx));

    println!("=== Validation Results ===");
    if errors.is_empty() {
        println!("All rules passed!");
    } else {
        for e in &errors {
            println!("[FAIL] {}: {}", e.field_path, e.message);
        }
    }

    // 3. Demonstrate validate_with_defaults convenience method
    // Uses a simpler schema without root-context variables (apiGroup/kind),
    // since validate_with_defaults does not accept a RootContext.
    println!("\n=== validate_with_defaults ===");
    let simple_schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        }
    });
    let sparse_object = json!({}); // no fields at all
    let errors = validator.validate_with_defaults(&simple_schema, &sparse_object, None);
    println!("Validating empty object with defaults applied:");
    if errors.is_empty() {
        println!("All rules passed (replicas defaulted to 1, strategy to RollingUpdate)");
    } else {
        for e in &errors {
            println!("[FAIL] {}", e.message);
        }
    }
}

pub fn validate_compiled( &self, compiled: &CompiledSchema, object: &Value, old_object: Option<&Value>, ) -> Vec<ValidationError>

Validate an object using a pre-compiled schema tree.

Use compile_schema to build the CompiledSchema, then call this method for each object to validate — rules are compiled only once.

pub fn validate_compiled_with_context( &self, compiled: &CompiledSchema, object: &Value, old_object: Option<&Value>, root_ctx: Option<&RootContext>, ) -> Vec<ValidationError>

Validate an object using a pre-compiled schema tree, with optional root context.

Like validate_compiled, but also binds apiVersion, apiGroup, and kind as root-level CEL variables when a RootContext is provided.

pub fn validate_with_defaults( &self, schema: &Value, object: &Value, old_object: Option<&Value>, ) -> Vec<ValidationError>

Validate with schema defaults applied to the object first.

Equivalent to calling crate::validation::defaults::apply_defaults followed by validate.

Examples found in repository

examples/defaults_and_context.rs (line 79)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        },
        "x-kubernetes-validations": [
            {"rule": "apiGroup == 'apps'", "message": "only apps group allowed"},
            {"rule": "kind == 'Deployment'", "message": "must be a Deployment"}
        ]
    });

    // Object with missing fields (would have defaults in K8s)
    let object = json!({"replicas": 3});

    // 1. Apply defaults
    let defaulted = apply_defaults(&schema, &object);
    println!("=== Default Injection ===");
    println!("Before: {object}");
    println!("After:  {defaulted}\n");

    // 2. Validate with root context
    let root_ctx = RootContext {
        api_version: "apps/v1".into(),
        api_group: "apps".into(),
        kind: "Deployment".into(),
    };

    let validator = Validator::new();
    let errors = validator.validate_with_context(&schema, &defaulted, None, Some(&root_ctx));

    println!("=== Validation Results ===");
    if errors.is_empty() {
        println!("All rules passed!");
    } else {
        for e in &errors {
            println!("[FAIL] {}: {}", e.field_path, e.message);
        }
    }

    // 3. Demonstrate validate_with_defaults convenience method
    // Uses a simpler schema without root-context variables (apiGroup/kind),
    // since validate_with_defaults does not accept a RootContext.
    println!("\n=== validate_with_defaults ===");
    let simple_schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        }
    });
    let sparse_object = json!({}); // no fields at all
    let errors = validator.validate_with_defaults(&simple_schema, &sparse_object, None);
    println!("Validating empty object with defaults applied:");
    if errors.is_empty() {
        println!("All rules passed (replicas defaulted to 1, strategy to RollingUpdate)");
    } else {
        for e in &errors {
            println!("[FAIL] {}", e.message);
        }
    }
}

pub fn validate_with_defaults_and_context( &self, schema: &Value, object: &Value, old_object: Option<&Value>, root_ctx: Option<&RootContext>, ) -> Vec<ValidationError>

Validate with schema defaults applied and root context variables bound.

Combines crate::validation::defaults::apply_defaults with Self::validate_with_context.

Trait Implementations

impl Debug for Validator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Validator

fn default() -> Self

Returns the “default value” for a type.