feat: add CEL validation rules to MemberCluster taint API types

[ytimocin]

Description of your changes

Adds CRD CEL validation for MemberCluster taints in both API versions (v1 and v1beta1) to match existing webhook validation behavior (defense-in-depth).

What changed

• API type updates:
  • Added CEL rules on MemberClusterSpec.Taints and Taint in:
    • apis/cluster/v1/membercluster_types.go
    • apis/cluster/v1beta1/membercluster_types.go
  • Rules cover:
    • taint key name segment format and max length
    • taint key prefix DNS-subdomain format and max length
    • taint value label-value format and max length
    • taint uniqueness by (key, value, effect)
• Regenerated CRD schema:
  • config/crd/bases/cluster.kubernetes-fleet.io_memberclusters.yaml
• Added integration validation coverage:
  • test/apis/cluster/v1/api_validation_integration_test.go
  • test/apis/cluster/v1beta1/api_validation_integration_test.go
  • Added comprehensive valid/invalid taint CEL cases for both versions.
• Updated webhook validator unit tests:
  • pkg/utils/validator/membercluster_test.go
  • Added coverage to confirm same key+effect with different value is valid.
• Updated e2e assertion:
  • test/e2e/webhook_test.go
  • Adjusted expected error message to match CEL validation output.
• Webhook logic is unchanged.

Why

• Enforces invalid taints earlier at CRD admission time.
• Keeps behavior consistent with the current webhook validator.

How has this code been tested

• go test ./pkg/utils/validator -run TestValidateTaints -count=1
• go test ./pkg/webhook/membercluster -count=1
• go test -c ./test/apis/cluster/v1 -o /tmp/test-apis-cluster-v1.test
• go test -c ./test/apis/cluster/v1beta1 -o /tmp/test-apis-cluster-v1beta1.test
• Focused API integration commands:
  • go test ./test/apis/cluster/v1 -run TestAPIs -count=1 -- -ginkgo.focus="MemberCluster taint CEL validation" -ginkgo.v
  • go test ./test/apis/cluster/v1beta1 -run TestAPIs -count=1 -- -ginkgo.focus="MemberCluster taint CEL validation" -ginkgo.v

Special notes for your reviewer

• Requests failing CEL validation are rejected before reaching the webhook, so some error messages now come from CEL/CRD validation.

I have:

• Run make reviewable to ensure this PR is ready for review.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Adds CRD-level CEL validations for MemberCluster taints (v1 + v1beta1) so invalid taints are rejected at schema validation time, aligning with existing webhook validation for defense-in-depth.

Changes:

• Added CEL rules and length constraints to MemberClusterSpec.Taints / Taint in both API versions (format, prefix/name/value limits, and uniqueness by (key,value,effect)).
• Regenerated the MemberCluster CRD schema to include the new validations.
• Expanded validation coverage via API integration tests (v1 + v1beta1), updated validator unit tests, and adjusted an e2e assertion to match CEL error output.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
apis/cluster/v1/membercluster_types.go	Adds CEL validations + length constraints for taints in v1 API types.
apis/cluster/v1beta1/membercluster_types.go	Adds the same CEL validations + constraints for v1beta1 API types.
config/crd/bases/cluster.kubernetes-fleet.io_memberclusters.yaml	CRD schema regeneration to include taint CEL validations and max/min length constraints.
test/apis/cluster/v1/api_validation_integration_test.go	Adds integration coverage for valid/invalid taint CEL cases (v1).
test/apis/cluster/v1beta1/api_validation_integration_test.go	Adds integration coverage for valid/invalid taint CEL cases (v1beta1).
pkg/utils/validator/membercluster_test.go	Adds a unit test covering “same key+effect, different value” as valid (uniqueness is by key+value+effect).
test/e2e/webhook_test.go	Updates expected error text to match CEL/CRD validation output.

[Copilot]

This assertion uses MatchRegexp with a literal string that contains regex metacharacters (notably the unescaped "."), which can make the test pass for unintended messages. Consider using ContainSubstring for this check, or wrapping the expected message with regexp.QuoteMeta() before passing it to MatchRegexp to ensure the regex matches the literal text.