Struct Validator 

pub struct Validator { /* private fields */ }

Available on crate feature validation only.

Validates Kubernetes objects against CRD schema CEL validation rules.

Walks the OpenAPI schema tree, compiles x-kubernetes-validations rules at each node, and evaluates them against the corresponding object values.

For repeated validation against the same schema, use compile_schema + validate_compiled to avoid re-compilation.

Thread Safety

Validator is Send and can be moved across threads.

Implementations

impl Validator

pub fn new() -> Self

Create a new Validator with all K8s CEL functions pre-registered.

Examples found in repository

examples/message_expression.rs (line 35)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "spec": {
                "type": "object",
                "properties": {
                    "replicas": {"type": "integer"}
                },
                "x-kubernetes-validations": [{
                    "rule": "self.replicas <= 5",
                    // Static fallback, used if messageExpression is absent/non-string.
                    "message": "too many replicas",
                    // Dynamic message: embeds the actual value and the limit.
                    "messageExpression":
                        "'requested ' + string(self.replicas) + ' replicas, max allowed is 5'"
                }]
            }
        }
    });

    let validator = Validator::new();

    // Two invalid objects: the dynamic message differs per object.
    for replicas in [8, 20] {
        let object = json!({"spec": {"replicas": replicas}});
        if let Err(errors) = validator.validate(&schema, &object, None) {
            for err in &errors {
                // Note the message reflects this object's value, not a fixed string.
                println!("replicas={replicas}: {}", err.message);
            }
        }
    }

    // A valid object produces no errors (and so no message at all).
    let ok = json!({"spec": {"replicas": 3}});
    match validator.validate(&schema, &ok, None) {
        Ok(()) => println!("replicas=3: 0 error(s)"),
        Err(errors) => println!("replicas=3: {} error(s)", errors.len()),
    }
}

examples/transition_rules.rs (line 38)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "storageClass": {"type": "string"},
            "replicas": {"type": "integer"}
        },
        "x-kubernetes-validations": [
            // Immutable field: may never change once set.
            {
                "rule": "self.storageClass == oldSelf.storageClass",
                "message": "storageClass is immutable"
            },
            // Monotonic: replicas may only grow (no scale-down).
            {
                "rule": "self.replicas >= oldSelf.replicas",
                "message": "replicas cannot be decreased"
            }
        ]
    });

    let validator = Validator::new();
    let stored = json!({"storageClass": "fast-ssd", "replicas": 3});

    // CREATE: no previous state, so transition rules are skipped entirely.
    let created = json!({"storageClass": "fast-ssd", "replicas": 3});
    report("CREATE (old = None)", validator.validate(&schema, &created, None));

    // UPDATE that respects both rules: same storageClass, scaling up.
    let scale_up = json!({"storageClass": "fast-ssd", "replicas": 5});
    report(
        "UPDATE scale up 3->5",
        validator.validate(&schema, &scale_up, Some(&stored)),
    );

    // UPDATE that violates the monotonic rule: scaling down.
    let scale_down = json!({"storageClass": "fast-ssd", "replicas": 1});
    report(
        "UPDATE scale down 3->1",
        validator.validate(&schema, &scale_down, Some(&stored)),
    );

    // UPDATE that mutates an immutable field.
    let restorage = json!({"storageClass": "cheap-hdd", "replicas": 3});
    report(
        "UPDATE change storageClass",
        validator.validate(&schema, &restorage, Some(&stored)),
    );
}

examples/kube_workflow.rs (line 29)

fn main() {
    // In a real controller this comes from the cluster, e.g.:
    //     use kube::{Api, Client};
    //     use k8s_openapi::apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition;
    //     let crds: Api<CustomResourceDefinition> = Api::all(client);
    //     let crd = crds.get("widgets.example.com").await?;
    //     let schema = crd.spec.versions[0].schema.unwrap().open_api_v3_schema.unwrap();
    // Here we mock that fetched OpenAPI v3 schema directly.
    let schema = fetch_crd_schema();

    let validator = Validator::new();

    // A controller reconcile loop typically builds a *desired* object and applies
    // it. We show two desired states: one valid, one that violates the CRD rules.
    let desired_ok = json!({
        "spec": { "replicas": 3, "image": "registry.example.com/widget:1.4.2" }
    });
    let desired_bad = json!({
        "spec": { "replicas": 0, "image": "widget:latest" }
    });

    for (label, desired) in [("valid desired", &desired_ok), ("invalid desired", &desired_bad)] {
        println!("=== reconcile: {label} ===");

        // Client-side gate, run BEFORE touching the apiserver.
        match validator.validate(&schema, desired, None) {
            Ok(()) => {
                println!("  validation passed -> apply to cluster");
                // The real apply happens only on the happy path:
                //     let widgets: Api<Widget> = Api::namespaced(client, "default");
                //     widgets.patch("my-widget", &PatchParams::apply("my-controller"),
                //                   &Patch::Apply(desired)).await?;
            }
            Err(errors) => {
                println!("  validation failed -> skip apply, record on status:");
                for err in &errors {
                    println!("    [{}] {}", err.field_path, err.message);
                }
                // Instead of a doomed apply, the controller would surface the reason:
                //     widgets.patch_status("my-widget", &pp,
                //         &Patch::Merge(json!({"status": {"validationError": err.message}}))).await?;
            }
        }
        println!();
    }
}

examples/validate_crd.rs (line 29)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "spec": {
                "type": "object",
                "properties": {
                    "replicas": {
                        "type": "integer",
                        "x-kubernetes-validations": [
                            {"rule": "self >= 0", "message": "replicas must be non-negative"}
                        ]
                    }
                },
                "x-kubernetes-validations": [
                    {"rule": "self.replicas >= 1", "message": "at least one replica required"}
                ]
            }
        }
    });

    let validator = Validator::new();

    // Valid object
    let valid = json!({"spec": {"replicas": 3}});
    match validator.validate(&schema, &valid, None) {
        Ok(()) => println!("Valid object: OK"),
        Err(errors) => println!("Valid object: {} errors", errors.len()),
    }

    // Invalid object
    let invalid = json!({"spec": {"replicas": -1}});
    if let Err(errors) = validator.validate(&schema, &invalid, None) {
        println!("\nInvalid object: {} errors", errors.len());
        for err in &errors {
            println!("  [{path}] {msg}", path = err.field_path, msg = err.message);
        }
    }

    // Transition rule (update check)
    let transition_schema = json!({
        "type": "object",
        "x-kubernetes-validations": [{
            "rule": "self.replicas >= oldSelf.replicas",
            "message": "cannot scale down"
        }],
        "properties": {
            "replicas": {"type": "integer"}
        }
    });

    let new_obj = json!({"replicas": 2});
    let old_obj = json!({"replicas": 5});

    // Create (no old object): transition rule skipped
    match validator.validate(&transition_schema, &new_obj, None) {
        Ok(()) => println!("\nCreate (no old): OK"),
        Err(errors) => println!("\nCreate (no old): {} errors", errors.len()),
    }

    // Update (scale down): transition rule fires
    if let Err(errors) = validator.validate(&transition_schema, &new_obj, Some(&old_obj)) {
        println!("Update (scale down): {} errors", errors.len());
        for err in &errors {
            println!("  {}", err);
        }
    }
}

examples/error_chain.rs (line 39)

fn main() {
    // Three rules, each failing a different way against the same object.
    let schema = json!({
        "type": "object",
        "x-kubernetes-validations": [
            // (1) the object simply violates the rule -> ValidationFailure
            {"rule": "self.replicas >= 1", "message": "replicas must be at least 1"},
            // (2) the rule references a field that isn't there -> EvaluationError
            //     (compiles fine, errors at runtime; the cel error is the cause)
            {"rule": "self.maxSurge > 0", "message": "maxSurge must be positive"},
            // (3) the rule uses a CEL macro cel 0.13 can't evaluate -> UnsupportedReference
            {"rule": "self.zones.sortBy(z, z) == self.zones", "message": "zones must be sorted"}
        ],
        "properties": {
            "replicas": {"type": "integer"},
            "zones": {"type": "array", "items": {"type": "string"}}
        }
    });

    let object = json!({"replicas": 0, "zones": ["b", "a"]});

    let errors = Validator::new()
        .validate(&schema, &object, None)
        .expect_err("object violates every rule, so validation must fail");

    println!("{} validation error(s)\n", errors.len());
    for err in &errors {
        println!("rule: {}", err.rule);
        println!("  kind: {:?}", err.kind);
        println!("  message: {err}");

        // Branch on the classification. `ErrorKind` is `#[non_exhaustive]`, so a
        // wildcard arm is required.
        match err.kind {
            ErrorKind::ValidationFailure => {
                println!("  -> the object violated the rule; reject it");
            }
            ErrorKind::EvaluationError => {
                println!("  -> the rule failed at runtime; likely a malformed object");
            }
            ErrorKind::UnsupportedReference => {
                println!("  -> coverage gap: this kube-cel build can't evaluate the rule");
            }
            _ => println!("  -> other ({:?})", err.kind),
        }

        // Walk the `source()` cause chain. Runtime failures carry the owned `cel`
        // execution error as their cause; pure ValidationFailure has none.
        let mut cause = err.source();
        if cause.is_none() {
            println!("  (no underlying cause)");
        }
        let mut depth = 1;
        while let Some(e) = cause {
            println!("  {:indent$}caused by: {e}", "", indent = depth * 2);
            cause = e.source();
            depth += 1;
        }
        println!();
    }
}

examples/defaults_and_context.rs (line 46)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        },
        "x-kubernetes-validations": [
            {"rule": "apiGroup == 'apps'", "message": "only apps group allowed"},
            {"rule": "kind == 'Deployment'", "message": "must be a Deployment"}
        ]
    });

    // Object with missing fields (would have defaults in K8s)
    let object = json!({"replicas": 3});

    // 1. Apply defaults
    let defaulted = apply_defaults(&schema, &object);
    println!("=== Default Injection ===");
    println!("Before: {object}");
    println!("After:  {defaulted}\n");

    // 2. Validate with root context
    let root_ctx = RootContext {
        api_version: "apps/v1".into(),
        api_group: "apps".into(),
        kind: "Deployment".into(),
    };

    let validator = Validator::new();
    let result = validator.validate_with_context(&schema, &defaulted, None, Some(&root_ctx));

    println!("=== Validation Results ===");
    match result {
        Ok(()) => println!("All rules passed!"),
        Err(errors) => {
            for e in &errors {
                println!("[FAIL] {}: {}", e.field_path, e.message);
            }
        }
    }

    // 3. Demonstrate validate_with_defaults convenience method
    // Uses a simpler schema without root-context variables (apiGroup/kind),
    // since validate_with_defaults does not accept a RootContext.
    println!("\n=== validate_with_defaults ===");
    let simple_schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        }
    });
    let sparse_object = json!({}); // no fields at all
    let result = validator.validate_with_defaults(&simple_schema, &sparse_object, None);
    println!("Validating empty object with defaults applied:");
    match result {
        Ok(()) => println!("All rules passed (replicas defaulted to 1, strategy to RollingUpdate)"),
        Err(errors) => {
            for e in &errors {
                println!("[FAIL] {}", e.message);
            }
        }
    }
}

pub fn validate( &self, schema: &Value, object: &Value, old_object: Option<&Value>, ) -> Result<(), ValidationErrors>

Validate an object against a CRD schema’s CEL validation rules.

Schema defaults are applied to the object before the rules run, matching the apiserver, which defaults during admission before evaluating CEL. A CR that omits a defaulted field is therefore validated as the apiserver sees it (with the default in place), not as the raw object.

Compiles rules on each call. For repeated validation against the same schema, prefer compile_schema + validate_compiled.

Examples found in repository

examples/message_expression.rs (line 40)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "spec": {
                "type": "object",
                "properties": {
                    "replicas": {"type": "integer"}
                },
                "x-kubernetes-validations": [{
                    "rule": "self.replicas <= 5",
                    // Static fallback, used if messageExpression is absent/non-string.
                    "message": "too many replicas",
                    // Dynamic message: embeds the actual value and the limit.
                    "messageExpression":
                        "'requested ' + string(self.replicas) + ' replicas, max allowed is 5'"
                }]
            }
        }
    });

    let validator = Validator::new();

    // Two invalid objects: the dynamic message differs per object.
    for replicas in [8, 20] {
        let object = json!({"spec": {"replicas": replicas}});
        if let Err(errors) = validator.validate(&schema, &object, None) {
            for err in &errors {
                // Note the message reflects this object's value, not a fixed string.
                println!("replicas={replicas}: {}", err.message);
            }
        }
    }

    // A valid object produces no errors (and so no message at all).
    let ok = json!({"spec": {"replicas": 3}});
    match validator.validate(&schema, &ok, None) {
        Ok(()) => println!("replicas=3: 0 error(s)"),
        Err(errors) => println!("replicas=3: {} error(s)", errors.len()),
    }
}

examples/transition_rules.rs (line 43)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "storageClass": {"type": "string"},
            "replicas": {"type": "integer"}
        },
        "x-kubernetes-validations": [
            // Immutable field: may never change once set.
            {
                "rule": "self.storageClass == oldSelf.storageClass",
                "message": "storageClass is immutable"
            },
            // Monotonic: replicas may only grow (no scale-down).
            {
                "rule": "self.replicas >= oldSelf.replicas",
                "message": "replicas cannot be decreased"
            }
        ]
    });

    let validator = Validator::new();
    let stored = json!({"storageClass": "fast-ssd", "replicas": 3});

    // CREATE: no previous state, so transition rules are skipped entirely.
    let created = json!({"storageClass": "fast-ssd", "replicas": 3});
    report("CREATE (old = None)", validator.validate(&schema, &created, None));

    // UPDATE that respects both rules: same storageClass, scaling up.
    let scale_up = json!({"storageClass": "fast-ssd", "replicas": 5});
    report(
        "UPDATE scale up 3->5",
        validator.validate(&schema, &scale_up, Some(&stored)),
    );

    // UPDATE that violates the monotonic rule: scaling down.
    let scale_down = json!({"storageClass": "fast-ssd", "replicas": 1});
    report(
        "UPDATE scale down 3->1",
        validator.validate(&schema, &scale_down, Some(&stored)),
    );

    // UPDATE that mutates an immutable field.
    let restorage = json!({"storageClass": "cheap-hdd", "replicas": 3});
    report(
        "UPDATE change storageClass",
        validator.validate(&schema, &restorage, Some(&stored)),
    );
}

examples/kube_workflow.rs (line 44)

fn main() {
    // In a real controller this comes from the cluster, e.g.:
    //     use kube::{Api, Client};
    //     use k8s_openapi::apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition;
    //     let crds: Api<CustomResourceDefinition> = Api::all(client);
    //     let crd = crds.get("widgets.example.com").await?;
    //     let schema = crd.spec.versions[0].schema.unwrap().open_api_v3_schema.unwrap();
    // Here we mock that fetched OpenAPI v3 schema directly.
    let schema = fetch_crd_schema();

    let validator = Validator::new();

    // A controller reconcile loop typically builds a *desired* object and applies
    // it. We show two desired states: one valid, one that violates the CRD rules.
    let desired_ok = json!({
        "spec": { "replicas": 3, "image": "registry.example.com/widget:1.4.2" }
    });
    let desired_bad = json!({
        "spec": { "replicas": 0, "image": "widget:latest" }
    });

    for (label, desired) in [("valid desired", &desired_ok), ("invalid desired", &desired_bad)] {
        println!("=== reconcile: {label} ===");

        // Client-side gate, run BEFORE touching the apiserver.
        match validator.validate(&schema, desired, None) {
            Ok(()) => {
                println!("  validation passed -> apply to cluster");
                // The real apply happens only on the happy path:
                //     let widgets: Api<Widget> = Api::namespaced(client, "default");
                //     widgets.patch("my-widget", &PatchParams::apply("my-controller"),
                //                   &Patch::Apply(desired)).await?;
            }
            Err(errors) => {
                println!("  validation failed -> skip apply, record on status:");
                for err in &errors {
                    println!("    [{}] {}", err.field_path, err.message);
                }
                // Instead of a doomed apply, the controller would surface the reason:
                //     widgets.patch_status("my-widget", &pp,
                //         &Patch::Merge(json!({"status": {"validationError": err.message}}))).await?;
            }
        }
        println!();
    }
}

examples/validate_crd.rs (line 33)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "spec": {
                "type": "object",
                "properties": {
                    "replicas": {
                        "type": "integer",
                        "x-kubernetes-validations": [
                            {"rule": "self >= 0", "message": "replicas must be non-negative"}
                        ]
                    }
                },
                "x-kubernetes-validations": [
                    {"rule": "self.replicas >= 1", "message": "at least one replica required"}
                ]
            }
        }
    });

    let validator = Validator::new();

    // Valid object
    let valid = json!({"spec": {"replicas": 3}});
    match validator.validate(&schema, &valid, None) {
        Ok(()) => println!("Valid object: OK"),
        Err(errors) => println!("Valid object: {} errors", errors.len()),
    }

    // Invalid object
    let invalid = json!({"spec": {"replicas": -1}});
    if let Err(errors) = validator.validate(&schema, &invalid, None) {
        println!("\nInvalid object: {} errors", errors.len());
        for err in &errors {
            println!("  [{path}] {msg}", path = err.field_path, msg = err.message);
        }
    }

    // Transition rule (update check)
    let transition_schema = json!({
        "type": "object",
        "x-kubernetes-validations": [{
            "rule": "self.replicas >= oldSelf.replicas",
            "message": "cannot scale down"
        }],
        "properties": {
            "replicas": {"type": "integer"}
        }
    });

    let new_obj = json!({"replicas": 2});
    let old_obj = json!({"replicas": 5});

    // Create (no old object): transition rule skipped
    match validator.validate(&transition_schema, &new_obj, None) {
        Ok(()) => println!("\nCreate (no old): OK"),
        Err(errors) => println!("\nCreate (no old): {} errors", errors.len()),
    }

    // Update (scale down): transition rule fires
    if let Err(errors) = validator.validate(&transition_schema, &new_obj, Some(&old_obj)) {
        println!("Update (scale down): {} errors", errors.len());
        for err in &errors {
            println!("  {}", err);
        }
    }
}

examples/error_chain.rs (line 40)

fn main() {
    // Three rules, each failing a different way against the same object.
    let schema = json!({
        "type": "object",
        "x-kubernetes-validations": [
            // (1) the object simply violates the rule -> ValidationFailure
            {"rule": "self.replicas >= 1", "message": "replicas must be at least 1"},
            // (2) the rule references a field that isn't there -> EvaluationError
            //     (compiles fine, errors at runtime; the cel error is the cause)
            {"rule": "self.maxSurge > 0", "message": "maxSurge must be positive"},
            // (3) the rule uses a CEL macro cel 0.13 can't evaluate -> UnsupportedReference
            {"rule": "self.zones.sortBy(z, z) == self.zones", "message": "zones must be sorted"}
        ],
        "properties": {
            "replicas": {"type": "integer"},
            "zones": {"type": "array", "items": {"type": "string"}}
        }
    });

    let object = json!({"replicas": 0, "zones": ["b", "a"]});

    let errors = Validator::new()
        .validate(&schema, &object, None)
        .expect_err("object violates every rule, so validation must fail");

    println!("{} validation error(s)\n", errors.len());
    for err in &errors {
        println!("rule: {}", err.rule);
        println!("  kind: {:?}", err.kind);
        println!("  message: {err}");

        // Branch on the classification. `ErrorKind` is `#[non_exhaustive]`, so a
        // wildcard arm is required.
        match err.kind {
            ErrorKind::ValidationFailure => {
                println!("  -> the object violated the rule; reject it");
            }
            ErrorKind::EvaluationError => {
                println!("  -> the rule failed at runtime; likely a malformed object");
            }
            ErrorKind::UnsupportedReference => {
                println!("  -> coverage gap: this kube-cel build can't evaluate the rule");
            }
            _ => println!("  -> other ({:?})", err.kind),
        }

        // Walk the `source()` cause chain. Runtime failures carry the owned `cel`
        // execution error as their cause; pure ValidationFailure has none.
        let mut cause = err.source();
        if cause.is_none() {
            println!("  (no underlying cause)");
        }
        let mut depth = 1;
        while let Some(e) = cause {
            println!("  {:indent$}caused by: {e}", "", indent = depth * 2);
            cause = e.source();
            depth += 1;
        }
        println!();
    }
}

pub fn validate_with_context( &self, schema: &Value, object: &Value, old_object: Option<&Value>, root_ctx: Option<&RootContext>, ) -> Result<(), ValidationErrors>

Validate an object against a CRD schema’s CEL validation rules, with optional root context.

Like validate, but also binds apiVersion, apiGroup, and kind as root-level CEL variables when a RootContext is provided.

Schema defaults are applied to the object before evaluation, matching the apiserver’s admission order (defaults run before CEL rules).

Examples found in repository

examples/defaults_and_context.rs (line 47)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        },
        "x-kubernetes-validations": [
            {"rule": "apiGroup == 'apps'", "message": "only apps group allowed"},
            {"rule": "kind == 'Deployment'", "message": "must be a Deployment"}
        ]
    });

    // Object with missing fields (would have defaults in K8s)
    let object = json!({"replicas": 3});

    // 1. Apply defaults
    let defaulted = apply_defaults(&schema, &object);
    println!("=== Default Injection ===");
    println!("Before: {object}");
    println!("After:  {defaulted}\n");

    // 2. Validate with root context
    let root_ctx = RootContext {
        api_version: "apps/v1".into(),
        api_group: "apps".into(),
        kind: "Deployment".into(),
    };

    let validator = Validator::new();
    let result = validator.validate_with_context(&schema, &defaulted, None, Some(&root_ctx));

    println!("=== Validation Results ===");
    match result {
        Ok(()) => println!("All rules passed!"),
        Err(errors) => {
            for e in &errors {
                println!("[FAIL] {}: {}", e.field_path, e.message);
            }
        }
    }

    // 3. Demonstrate validate_with_defaults convenience method
    // Uses a simpler schema without root-context variables (apiGroup/kind),
    // since validate_with_defaults does not accept a RootContext.
    println!("\n=== validate_with_defaults ===");
    let simple_schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        }
    });
    let sparse_object = json!({}); // no fields at all
    let result = validator.validate_with_defaults(&simple_schema, &sparse_object, None);
    println!("Validating empty object with defaults applied:");
    match result {
        Ok(()) => println!("All rules passed (replicas defaulted to 1, strategy to RollingUpdate)"),
        Err(errors) => {
            for e in &errors {
                println!("[FAIL] {}", e.message);
            }
        }
    }
}

pub fn validate_compiled( &self, compiled: &CompiledSchema, object: &Value, old_object: Option<&Value>, ) -> Result<(), ValidationErrors>

Validate an object using a pre-compiled schema tree.

Use compile_schema to build the CompiledSchema, then call this method for each object to validate — rules are compiled only once.

Schema defaults (retained on the compiled tree) are applied to the object before evaluation, matching validate and the apiserver.

pub fn validate_compiled_with_context( &self, compiled: &CompiledSchema, object: &Value, old_object: Option<&Value>, root_ctx: Option<&RootContext>, ) -> Result<(), ValidationErrors>

Validate an object using a pre-compiled schema tree, with optional root context.

Like validate_compiled, but also binds apiVersion, apiGroup, and kind as root-level CEL variables when a RootContext is provided.

pub fn validate_with_defaults( &self, schema: &Value, object: &Value, old_object: Option<&Value>, ) -> Result<(), ValidationErrors>

Validate with schema defaults applied to the object first.

Alias for validate. As of 0.8, plain validate applies schema defaults itself, so this method is equivalent and retained only for backward compatibility.

Examples found in repository

examples/defaults_and_context.rs (line 80)

fn main() {
    let schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        },
        "x-kubernetes-validations": [
            {"rule": "apiGroup == 'apps'", "message": "only apps group allowed"},
            {"rule": "kind == 'Deployment'", "message": "must be a Deployment"}
        ]
    });

    // Object with missing fields (would have defaults in K8s)
    let object = json!({"replicas": 3});

    // 1. Apply defaults
    let defaulted = apply_defaults(&schema, &object);
    println!("=== Default Injection ===");
    println!("Before: {object}");
    println!("After:  {defaulted}\n");

    // 2. Validate with root context
    let root_ctx = RootContext {
        api_version: "apps/v1".into(),
        api_group: "apps".into(),
        kind: "Deployment".into(),
    };

    let validator = Validator::new();
    let result = validator.validate_with_context(&schema, &defaulted, None, Some(&root_ctx));

    println!("=== Validation Results ===");
    match result {
        Ok(()) => println!("All rules passed!"),
        Err(errors) => {
            for e in &errors {
                println!("[FAIL] {}: {}", e.field_path, e.message);
            }
        }
    }

    // 3. Demonstrate validate_with_defaults convenience method
    // Uses a simpler schema without root-context variables (apiGroup/kind),
    // since validate_with_defaults does not accept a RootContext.
    println!("\n=== validate_with_defaults ===");
    let simple_schema = json!({
        "type": "object",
        "properties": {
            "replicas": {
                "type": "integer",
                "default": 1,
                "x-kubernetes-validations": [
                    {"rule": "self >= 0", "message": "replicas must be non-negative"}
                ]
            },
            "strategy": {
                "type": "string",
                "default": "RollingUpdate"
            }
        }
    });
    let sparse_object = json!({}); // no fields at all
    let result = validator.validate_with_defaults(&simple_schema, &sparse_object, None);
    println!("Validating empty object with defaults applied:");
    match result {
        Ok(()) => println!("All rules passed (replicas defaulted to 1, strategy to RollingUpdate)"),
        Err(errors) => {
            for e in &errors {
                println!("[FAIL] {}", e.message);
            }
        }
    }
}

pub fn validate_with_defaults_and_context( &self, schema: &Value, object: &Value, old_object: Option<&Value>, root_ctx: Option<&RootContext>, ) -> Result<(), ValidationErrors>

Validate with schema defaults applied and root context variables bound.

Alias for validate_with_context. As of 0.8, that method applies schema defaults itself, so this is equivalent and retained only for backward compatibility.

Trait Implementations

impl Debug for Validator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Validator

fn default() -> Self

Returns the “default value” for a type.