Kubernetes schema "strict-mode" rule doesn't get triggered for misspelled/gibberish "apiVersion" values for some resources

[f1ames]

This relates to "strict-mode" rule introduced in recent #374 PR.

The rule should also trigger for misspelled (or just gibberish) apiVersion values. However, for some resources it does not. This is because we pick schema for some kinds based only on kind value (and cluster version indirectly) totally ignoring provided apiVersion.

This is the code responsible for this behavior -

monokle-core/packages/validation/src/validators/kubernetes-schema/resourcePrefixMap.ts

Lines 3 to 37 in 1c90fe2

	export function getResourceSchemaPrefix(kind: string): string | undefined {
	const prefix = RESOURCE_SCHEMA_PREFIX[kind as KnownResourceKinds];
	return prefix;
	}
	export function matchResourceSchema(kind: string, apiVersion: string, availableDefinitions: string[]): string | undefined {
	const prefix = getResourceSchemaPrefix(kind);
	if (prefix) {
	return `${prefix}.${kind}`;
	}
	const suffix = `${apiVersion.split('/').pop()}.${kind}`;
	return availableDefinitions.find((definition) => definition.endsWith(suffix));
	}
	export const RESOURCE_SCHEMA_PREFIX: Partial<Record<KnownResourceKinds, string>> = {
	ClusterRole: 'io.k8s.api.rbac.v1',
	ClusterRoleBinding: 'io.k8s.api.rbac.v1',
	ConfigMap: 'io.k8s.api.core.v1',
	CronJob: 'io.k8s.api.batch.v1',
	CustomResourceDefinition: 'io.k8s.apiextensions-apiserver.pkg.apis.apiextensions.v1',
	DaemonSet: 'io.k8s.api.apps.v1',
	Deployment: 'io.k8s.api.apps.v1',
	HorizontalPodAutoscaler: 'io.k8s.api.autoscaling.v1',
	Ingress: 'io.k8s.api.networking.v1',
	Job: 'io.k8s.api.batch.v1',
	LimitRange: 'io.k8s.api.core.v1',
	Namespace: 'io.k8s.api.core.v1',
	NetworkPolicy: 'io.k8s.api.networking.v1',
	Service: 'io.k8s.api.core.v1',
	Role: 'io.k8s.api.rbac.v1',
	RoleBinding: 'io.k8s.api.rbac.v1',
	};

This also means that having a schema like:

apiVersion: apps/v1beta1
kind: Deployment
...

for a cluster version, e.g. 1.26.0 where apps/v1beta1 was removed and apps/v1 is expected, this whole schema will be validated as apps/v1. Not sure how much difference it would make though. And also now we have deprecation rules which can help with that.

So either it is intended behavior or we should add apiVersion value for consideration here. @WitoDelnat and thoughts on this?