fix: add additional name validation for custom resources

[cbzzz]

What type of PR is this?
/kind bug

What this PR does / why we need it:
This propagates the label constraints of Linode resources to their associated CAPL CustomResourceDefinitions via the Kubernetes Validation Rules feature. When a custom resource is created, the Kubernetes object name is validated against the label constraints of its backing Linode resources. This allows CAPL-managed resources to maintain a human-readable naming scheme between its Kubernetes representation and the backing Linode resource implementations.

See:

• https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules
• Metadata validation for CustomResources kubernetes/kubernetes#74620

Testing

1. Create Linode* resources with invalid names:

## LinodeCluster
$ export NAME="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" && kubectl apply -f - <<EOF
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
kind: LinodeCluster
metadata:
  name: ${NAME}
spec:
  region: us-sea
EOF

The LinodeCluster "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" is invalid: metadata.name: Invalid value: "string": custom validation: linode nodebalancer: labels must be between 3..32 characters

## LinodeMachine
$ export NAME="bad--name" && kubectl apply -f - <<EOF
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
kind: LinodeMachine
metadata:
    name: ${NAME}
spec:
    region: us-sea
    type: g5-nanode-1
EOF
The LinodeMachine "bad--name" is invalid: metadata.name: Invalid value: "string": custom validation: linode instance: labels cannot have two hyphens (--), underscores (__) or periods (..) in a row

## LinodeVPC
export NAME="bad.name"
kubectl apply -f - <<EOF
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
kind: LinodeVPC
metadata:
  name: ${NAME}
spec:
  region: us-sea
EOF
The LinodeVPC "bad.name" is invalid: metadata.name: Invalid value: "string": custom validation: linode vpc: labels: can only contain ASCII letters, numbers, and hyphens (-), cannot have two consecutive hyphens (--), regex used for validation is: '^[-[:alnum:]]*$', see: https://www.linode.com/docs/api/vpcs/#vpc-create

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:
Linode resources have constraints on the format of their labels, e.g.:

• https://www.linode.com/docs/api/nodebalancers/#nodebalancer-create
• https://www.linode.com/docs/api/linode-instances/#linode-create
• https://www.linode.com/docs/api/vpcs/#vpc-create

UIDs vs. Names
Prior to #143, CAPL was using the Kubernetes resource UID as a generalized injection(?) between the "space" of valid Kubernetes resource names (RFC 1123) to the "space" of valid Linode labels across various resource types. This provided three important properties:

1. Uniqueness
2. Identity: A Kubernetes resource can be mapped to a Linode resource label via its UID in the ObjectMeta.
3. Formatting: Kubernetes UIDs are standardized and well-formatted such that they do not break any existing Linode label constraints.

Why not validate in the controller?
It didn't seem as user-friendly to require users to debug through controller logs, resource events, etc. to fix what is essentially a naming error. Kubernetes already enforces metadata validation on resources and we can ratchet off that mechanism to inject in our own additive validation constraints to the built-in ones.

See: kubernetes/kubernetes#74620

Why not automatically format Linode labels?
For many Linode resources, labels also have an additional constraint that they must be unique across a resource type in an account. Auto-formatting labels could lead to a conflict where two independent Kubernetes resources attempt to use the same label for two independent Linode resources.

Unfortunately, this issue is still occurs if a user creates an object of the same name, but in a different namespace. 😢

TODOs:

• squashed commits
• includes documentation
• adds unit tests
• adds or updates e2e tests

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 42.10%. Comparing base (5343789) to head (42643cd).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #219   +/-   ##
=======================================
  Coverage   42.10%   42.10%           
=======================================
  Files          25       25           
  Lines        1375     1375           
=======================================
  Hits          579      579           
  Misses        783      783           
  Partials       13       13           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[eljohnson92]

would these commented-out rules be covered by the k8s default metadata.name validation already?

[cbzzz]

Not necessarily. For example, RFC 1123 allows double-hypens (which is disallowed by some Linode resource labels).

Some checks are covered (e.g. "must begin and end with an alphanumeric character"), but for the sake of completeness, I added it to the validation rules. I can look into smashing this all together into one regex if you'd like, but it (IMO) makes this very hard to read.

[eljohnson92]

yeah, I'm talking specifically lines 11-15 here

[cbzzz]

Yes, they should be. However, I opted to add in a 1:1 mapping with all the Linode instance label validation rules just to make this complete in itself and easier to read.

I can remove this though if you feel it's unnecessary 🙂

[eljohnson92]

that is fair, if we are going to leave it commented out could we just write something describe why we are keeping them in there but not enabling them?

[cbzzz]

I've cleaned up the commented-out rules and updated the error messages. I've also updated the "Testing" section of the Description to better show what the actual error messages from the API server would look like.

Technically, this rule in the LinodeMachine and LinodeMachineTemplate definitions is covered by the default validation, but I've left it in for context:

      - rule: self.matches('^[[:alnum:]]([-_.[:alnum:]]+[[:alnum:]])*$')
        message: >-
          custom validation:
          linode instance: labels:
          must begin and end with an alphanumeric character,
          may only consist of alphanumeric characters, hyphens (-), underscores (_) or periods (.),
          cannot have two hyphens (--), underscores (__) or periods (..) in a row,
          regex used for validation is: '^[[:alnum:]]([-_.[:alnum:]]+[[:alnum:]])*$',
          see: https://www.linode.com/docs/api/linode-instances/#linode-create

(and in case we would like to optimize this in the future by combining all the rules into one regex idk regex sue me 🤷‍♀️)

[komer3]

LGTM!