api: tighten runtime CRD validation

go.mod

@@ -7,8 +7,8 @@ toolchain go1.24.9
 require (
 	github.com/agiledragon/gomonkey/v2 v2.13.0
 	github.com/alicebob/miniredis/v2 v2.35.0
-	github.com/gin-contrib/gzip v1.0.1
 	github.com/fsnotify/fsnotify v1.9.0
+	github.com/gin-contrib/gzip v1.0.1
 	github.com/gin-gonic/gin v1.10.0
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/google/uuid v1.6.0

manifests/charts/base/crds/runtime.agentcube.volcano.sh_agentruntimes.yaml

@@ -48,7 +48,11 @@ spec:
                 description: |-
                   MaxSessionDuration describes the maximum duration for a session.
                   After this duration, the session will be terminated no matter active or inactive.
+                format: duration
                 type: string
+                x-kubernetes-validations:
+                - message: maxSessionDuration must be greater than 0
+                  rule: duration(self) > duration('0s')
               podTemplate:
                 description: PodTemplate describes the template that will be used
                   to create an agent sandbox.
@@ -8472,7 +8476,11 @@ spec:
                 default: 15m
                 description: SessionTimeout describes the duration after which an
                   inactive session will be terminated.
+                format: duration
                 type: string
+                x-kubernetes-validations:
+                - message: sessionTimeout must be greater than 0
+                  rule: duration(self) > duration('0s')
               targetPort:
                 description: Ports is a list of ports that the agent runtime will
                   expose.
@@ -8486,10 +8494,13 @@ spec:
                       description: |-
                         PathPrefix is the path prefix to route to this port.
                         For example, if PathPrefix is "/api", requests to "/api/..." will be routed to this port.
+                      pattern: ^/.*
                       type: string
                     port:
                       description: Port is the port number.
                       format: int32
+                      maximum: 65535
+                      minimum: 1
                       type: integer
                     protocol:
                       default: HTTP
@@ -8509,6 +8520,10 @@ spec:
             - sessionTimeout
             - targetPort
             type: object
+            x-kubernetes-validations:
+            - message: sessionTimeout must be less than or equal to maxSessionDuration
+              rule: '!has(self.sessionTimeout) || !has(self.maxSessionDuration) ||
+                duration(self.sessionTimeout) <= duration(self.maxSessionDuration)'
           status:
             description: Status represents the current state of the AgentRuntime.
             properties:

manifests/charts/base/crds/runtime.agentcube.volcano.sh_codeinterpreters.yaml

@@ -64,7 +64,11 @@ spec:
                   MaxSessionDuration describes the maximum duration for a code-interpreter session.
                   After this duration, the session will be terminated regardless of activity, to
                   prevent long-lived sandboxes from accumulating unbounded state.
+                format: duration
                 type: string
+                x-kubernetes-validations:
+                - message: maxSessionDuration must be greater than 0
+                  rule: duration(self) > duration('0s')
               ports:
                 description: |-
                   Ports is a list of ports that the code interpreter runtime will expose.
@@ -81,10 +85,13 @@ spec:
                       description: |-
                         PathPrefix is the path prefix to route to this port.
                         For example, if PathPrefix is "/api", requests to "/api/..." will be routed to this port.
+                      pattern: ^/.*
                       type: string
                     port:
                       description: Port is the port number.
                       format: int32
+                      maximum: 65535
+                      minimum: 1
                       type: integer
                     protocol:
                       default: HTTP
@@ -104,7 +111,11 @@ spec:
                   SessionTimeout describes the duration after which an inactive code-interpreter
                   session will be terminated. Any sandbox that has not received requests within
                   this duration is eligible for cleanup.
+                format: duration
                 type: string
+                x-kubernetes-validations:
+                - message: sessionTimeout must be greater than 0
+                  rule: duration(self) > duration('0s')
               template:
                 description: |-
                   Template describes the template that will be used to create a code interpreter sandbox.
@@ -405,10 +416,15 @@ spec:
                   for this code interpreter runtime. Pre-warmed sandboxes can reduce startup
                   latency for new sessions at the cost of additional resource usage.
                 format: int32
+                minimum: 0
                 type: integer
             required:
             - template
             type: object
+            x-kubernetes-validations:
+            - message: sessionTimeout must be less than or equal to maxSessionDuration
+              rule: '!has(self.sessionTimeout) || !has(self.maxSessionDuration) ||
+                duration(self.sessionTimeout) <= duration(self.maxSessionDuration)'
           status:
             description: Status represents the current state of the CodeInterpreter.
             properties:

pkg/apis/runtime/v1alpha1/agent_type.go

@@ -38,6 +38,7 @@ type AgentRuntime struct {
 }
 
 // AgentRuntimeSpec describes how to create and manage agent runtime sandboxes.
+// +kubebuilder:validation:XValidation:rule="!has(self.sessionTimeout) || !has(self.maxSessionDuration) || duration(self.sessionTimeout) <= duration(self.maxSessionDuration)",message="sessionTimeout must be less than or equal to maxSessionDuration"
 type AgentRuntimeSpec struct {
 	// Ports is a list of ports that the agent runtime will expose.
 	Ports []TargetPort `json:"targetPort"`
@@ -48,12 +49,16 @@ type AgentRuntimeSpec struct {
 
 	// SessionTimeout describes the duration after which an inactive session will be terminated.
 	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Format=duration
+	// +kubebuilder:validation:XValidation:rule="duration(self) > duration('0s')",message="sessionTimeout must be greater than 0"
 	// +kubebuilder:default="15m"
 	SessionTimeout *metav1.Duration `json:"sessionTimeout,omitempty" protobuf:"bytes,2,opt,name=sessionTimeout"`
 
 	// MaxSessionDuration describes the maximum duration for a session.
 	// After this duration, the session will be terminated no matter active or inactive.
 	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Format=duration
+	// +kubebuilder:validation:XValidation:rule="duration(self) > duration('0s')",message="maxSessionDuration must be greater than 0"
 	// +kubebuilder:default="8h"
 	MaxSessionDuration *metav1.Duration `json:"maxSessionDuration,omitempty" protobuf:"bytes,3,opt,name=maxSessionDuration"`
 }

pkg/apis/runtime/v1alpha1/codeinterpreter_types.go

@@ -42,6 +42,7 @@ type CodeInterpreter struct {
 }
 
 // CodeInterpreterSpec describes how to create and manage code-interpreter sandboxes.
+// +kubebuilder:validation:XValidation:rule="!has(self.sessionTimeout) || !has(self.maxSessionDuration) || duration(self.sessionTimeout) <= duration(self.maxSessionDuration)",message="sessionTimeout must be less than or equal to maxSessionDuration"
 type CodeInterpreterSpec struct {
 	// Ports is a list of ports that the code interpreter runtime will expose.
 	// These ports are typically used by the router / apiserver to proxy HTTP or gRPC
@@ -59,19 +60,24 @@ type CodeInterpreterSpec struct {
 	// SessionTimeout describes the duration after which an inactive code-interpreter
 	// session will be terminated. Any sandbox that has not received requests within
 	// this duration is eligible for cleanup.
+	// +kubebuilder:validation:Format=duration
+	// +kubebuilder:validation:XValidation:rule="duration(self) > duration('0s')",message="sessionTimeout must be greater than 0"
 	// +kubebuilder:default="15m"
 	SessionTimeout *metav1.Duration `json:"sessionTimeout,omitempty"`
 
 	// MaxSessionDuration describes the maximum duration for a code-interpreter session.
 	// After this duration, the session will be terminated regardless of activity, to
 	// prevent long-lived sandboxes from accumulating unbounded state.
+	// +kubebuilder:validation:Format=duration
+	// +kubebuilder:validation:XValidation:rule="duration(self) > duration('0s')",message="maxSessionDuration must be greater than 0"
 	// +kubebuilder:default="8h"
 	MaxSessionDuration *metav1.Duration `json:"maxSessionDuration,omitempty"`
 
 	// WarmPoolSize specifies the number of pre-warmed sandboxes to maintain
 	// for this code interpreter runtime. Pre-warmed sandboxes can reduce startup
 	// latency for new sessions at the cost of additional resource usage.
 	// +optional
+	// +kubebuilder:validation:Minimum=0
 	WarmPoolSize *int32 `json:"warmPoolSize,omitempty"`
 
 	// AuthMode specifies the authentication mode for the sandbox runtime.
@@ -158,11 +164,14 @@ type TargetPort struct {
 	// PathPrefix is the path prefix to route to this port.
 	// For example, if PathPrefix is "/api", requests to "/api/..." will be routed to this port.
 	// +optional
+	// +kubebuilder:validation:Pattern=`^/.*`
 	PathPrefix string `json:"pathPrefix,omitempty"`
 	// Name is the name of the port.
 	// +optional
 	Name string `json:"name,omitempty"`
 	// Port is the port number.
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=65535
 	Port uint32 `json:"port"`
 	// Protocol is the protocol of the port.
 	// +kubebuilder:default=HTTP