WIP: First cut at input validation for Kubelet

* Add some util functions for basic validation
* Spec api fields more tightly
* Break a dep from util -> api, so I can do the reverse
* Add functions to validate structures
* Call those functions when running manifests

This does not validate as it unmarshals YAML or JSON because I want to be able
to validate structures that come from other inputs without forcing them to be
YAML.

This does not handle all api structures - I am not familiar wnough with the
rest to spec them this tightly - I hope someone else can do that.

There are a number of open questions, marked "FIXME".  Please offer feedback
or opinions.
The problem with doing it early is that you then have to do it in every
entry point.  This is the first choke point that I can see.  Now, nothing
prevents us from ALSO checking it master-side...


On Fri, Jun 27, 2014 at 10:10 PM, Daniel Smith <notifications@github.com>
wrote:

> In pkg/kubelet/kubelet.go:
>
> > @@ -726,12 +726,18 @@ func (kl *Kubelet) RunSyncLoop(updateChannel <-chan manifestUpdate, handler Sync
> >  		case <-time.After(kl.SyncFrequency):
> >  		}
> >
> > -		manifests := []api.ContainerManifest{}
> > -		for _, m := range last {
> > -			manifests = append(manifests, m...)
> > +		allManifests := []api.ContainerManifest{}
> > +		for src, manifests := range last {
> > +			for _, m := range manifests {
> > +				if err := api.ValidateManifest(&m); err != nil {
>
> I feel like this is a bit late in the game to do the validation. I think
> we should check at the control surfaces, not right before we're about to
> launch the containers. So for etcd, that'd be registry/pod_registry.go, and
> for the other methods, that'd be before the manifests are written to the
> update channel.
>
> --
> Reply to this email directly or view it on GitHub
> <https://github.com/GoogleCloudPlatform/kubernetes/pull/280/files#r14322608>
> .
>