hosted: describe every schema node so the Provider manifest passes core admission (#19)

The 0.4.0 hosted Provider was rejected by the core validating webhook on a
live PMC (nameServers.items.description is required) and the chart's
dns-api-controller Application stayed SyncError; only Route 53 and
Cloudflare manifests were admitted in tests. Add the missing descriptions
and a contract test that admits every packaged Provider manifest
(external, hosted, route53, cloudflare) through validateProvider.

Author: reoring

deploy/charts/dns-api/templates/provider-hosted.yaml

@@ -27,6 +27,7 @@ spec:
                   maxItems: 8
                   items:
                     type: object
+                    description: One authoritative nameserver and its glue addresses.
                     additionalProperties: false
                     required: [name, addresses]
                     properties:
@@ -43,6 +44,7 @@ spec:
                         maxItems: 8
                         items:
                           type: string
+                          description: One canonical IPv4 or IPv6 glue address.
                           minLength: 2
                           maxLength: 45
                 soa:
@@ -58,21 +60,25 @@ spec:
                       pattern: '^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$'
                     refresh:
                       type: integer
+                      description: SOA refresh interval in seconds.
                       minimum: 1
                       maximum: 2419200
                       default: 3600
                     retry:
                       type: integer
+                      description: SOA retry interval in seconds.
                       minimum: 1
                       maximum: 2419200
                       default: 900
                     expire:
                       type: integer
+                      description: SOA expire interval in seconds.
                       minimum: 1
                       maximum: 2419200
                       default: 1209600
                     minimum:
                       type: integer
+                      description: SOA negative-caching TTL in seconds; the withdrawal evaluator uses it as the cache horizon.
                       minimum: 1
                       maximum: 2419200
                       default: 300
@@ -84,6 +90,7 @@ spec:
                   default: 60
                 verification:
                   type: object
+                  description: Read-only verification views and parent delegation observation.
                   additionalProperties: false
                   properties:
                     views:
@@ -93,6 +100,7 @@ spec:
                       uniqueItems: true
                       items:
                         type: string
+                        description: One canonical IP:port DNS endpoint.
                         minLength: 3
                         maxLength: 64
                         pattern: '^(\[[0-9a-f:.]+\]|[0-9.]+):[1-9][0-9]{0,4}$'
@@ -167,6 +175,7 @@ spec:
           adoption: &empty
             openAPIV3Schema:
               type: object
+              description: Hosted zones carry no provider adoption or record options payload.
               additionalProperties: false
               properties: {}
           statusProviderData:

internal/go/core/webhook/provider_manifests_test.go

@@ -0,0 +1,40 @@
+package webhook
+
+import (
+	"testing"
+
+	externalmanifest "github.com/appthrust/dns-api/internal/go/providers/external/manifest"
+	hostedmanifest "github.com/appthrust/dns-api/internal/go/providers/hosted/manifest"
+	dnsv1alpha1 "github.com/appthrust/dns-api/pkg/go/api/dns/v1alpha1"
+	"sigs.k8s.io/yaml"
+)
+
+// Every packaged Provider manifest must pass the same admission the core
+// webhook applies when the chart installs it. The hosted 0.4.0 manifest was
+// rejected live (`nameServers.items.description is required`) because only
+// Route 53 and Cloudflare were admitted in tests.
+func TestBuiltInProviderManifestsPassAdmission(t *testing.T) {
+	manifests := map[string][]byte{
+		"external": externalmanifest.ProviderYAML,
+		"hosted":   hostedmanifest.ProviderYAML,
+	}
+	for name, file := range map[string]string{"route53": "route53_extensions.yaml", "cloudflare": "cloudflare_extensions.yaml"} {
+		provider := builtInProviderManifest(t, file)
+		data, err := yaml.Marshal(provider)
+		if err != nil {
+			t.Fatal(err)
+		}
+		manifests[name] = data
+	}
+	for name, data := range manifests {
+		t.Run(name, func(t *testing.T) {
+			var provider dnsv1alpha1.Provider
+			if err := yaml.Unmarshal(data, &provider); err != nil {
+				t.Fatalf("unmarshal %s provider: %v", name, err)
+			}
+			if err := validateProvider(&provider); err != nil {
+				t.Fatalf("validateProvider(%s): %v", name, err)
+			}
+		})
+	}
+}

internal/go/providers/hosted/manifest/provider.yaml

@@ -26,6 +26,7 @@ spec:
                   maxItems: 8
                   items:
                     type: object
+                    description: One authoritative nameserver and its glue addresses.
                     additionalProperties: false
                     required: [name, addresses]
                     properties:
@@ -42,6 +43,7 @@ spec:
                         maxItems: 8
                         items:
                           type: string
+                          description: One canonical IPv4 or IPv6 glue address.
                           minLength: 2
                           maxLength: 45
                 soa:
@@ -57,21 +59,25 @@ spec:
                       pattern: '^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$'
                     refresh:
                       type: integer
+                      description: SOA refresh interval in seconds.
                       minimum: 1
                       maximum: 2419200
                       default: 3600
                     retry:
                       type: integer
+                      description: SOA retry interval in seconds.
                       minimum: 1
                       maximum: 2419200
                       default: 900
                     expire:
                       type: integer
+                      description: SOA expire interval in seconds.
                       minimum: 1
                       maximum: 2419200
                       default: 1209600
                     minimum:
                       type: integer
+                      description: SOA negative-caching TTL in seconds; the withdrawal evaluator uses it as the cache horizon.
                       minimum: 1
                       maximum: 2419200
                       default: 300
@@ -83,6 +89,7 @@ spec:
                   default: 60
                 verification:
                   type: object
+                  description: Read-only verification views and parent delegation observation.
                   additionalProperties: false
                   properties:
                     views:
@@ -92,6 +99,7 @@ spec:
                       uniqueItems: true
                       items:
                         type: string
+                        description: One canonical IP:port DNS endpoint.
                         minLength: 3
                         maxLength: 64
                         pattern: '^(\[[0-9a-f:.]+\]|[0-9.]+):[1-9][0-9]{0,4}$'
@@ -166,6 +174,7 @@ spec:
           adoption: &empty
             openAPIV3Schema:
               type: object
+              description: Hosted zones carry no provider adoption or record options payload.
               additionalProperties: false
               properties: {}
           statusProviderData: