Introduce CEL based validation in App spec for SA and Cluster

[varshaprasad96]

Describe the problem/challenge you have

Tried creating an App CR with no service account or cluster specified. The resource got created, but reconcile errored stating:
Reconcile failed: Preparing kapp: Expected service account or cluster specified. The documentation states that both of them are optional fields, hence as a user I'm unaware that one of them needs to be specified.

Describe the solution you'd like

Based on the conversation here, it does make sense to either have the user specify the target cluster where App CR needs to be installed, or the sa which needs to be used to install it in the same cluster. However, running this validation after the resource is created is not necessary (refer:

kapp-controller/pkg/kubeconfig/kubeconfig.go

Line 75 in 5b1294b

return AccessInfo{}, fmt.Errorf("Expected service account or cluster specified")

). This can also be done on the admission control level before an App CR is created.

Solution: Add CEL based validation to ensure that one of them are specified.

Anything else you would like to add:

None

---

Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

[varshaprasad96]

@prembhaskal Sorry, I missed that you had assigned this issue. Could you please help in reviewing the PR? Thank you!

[prembhaskal]

Thank you for reporting the issue. I am checking the PR.

[GrahamDumpleton]

Old related issue: #598