THREESCALE-11841 Update validation to match Porta

[borisurbanik]

Fixes:

• https://redhat.atlassian.net/browse/THREESCALE-11841

Validation

Set up minimal 3scale dev environment.

This PR touches CRDs - re-create them. This is very destructive so make sure you're on a throwaway cluster.

make uninstall
make install

oc new-project $NAMESPACE
make cluster/create/system-mysql
make cluster/create/system-redis
make cluster/create/backend-redis

cat << EOF | oc create -f -
kind: Secret
apiVersion: v1
metadata:
  name: s3-credentials
  namespace: $NAMESPACE
data:
  AWS_ACCESS_KEY_ID: c29tZXRoaW5nCg==
  AWS_BUCKET: c29tZXRoaW5nCg==
  AWS_REGION: dXMtd2VzdC0xCg==
  AWS_SECRET_ACCESS_KEY: c29tZXRoaW5nCg==
type: Opaque
EOF

DOMAIN=$(oc get routes console -n openshift-console -o json | jq -r '.status.ingress[0].routerCanonicalHostname' | sed 's/router-default.//')
cat << EOF | oc create -f -
kind: APIManager
apiVersion: apps.3scale.net/v1alpha1
metadata:
  name: 3scale
  namespace: $NAMESPACE
spec:
  wildcardDomain: $DOMAIN
  system:
    fileStorage:
      simpleStorageService:
        configurationSecretRef:
          name: s3-credentials
  backend:
  externalComponents:
    backend:
      redis: true
    system:
      database: true
      redis: true
EOF

Run the operator locally.

make run

Wait for reconciliation.

Then test the OpenApi will be created with underscore in the name:

note: the successful processing of activedoc requires fix #1192 to be applied

cat << 'EOF' > test-activedoc-underscore.yaml
apiVersion: capabilities.3scale.net/v1beta1
kind: ActiveDoc
metadata:
  name: test-activedoc-underscore
  annotations:
    insecure_skip_verify: "true"
spec:
  name: "Test ActiveDoc"
  systemName: "test_activedoc"
  activeDocOpenAPIRef:
    url: "https://gist.githubusercontent.com/borisurbanik/3dbc318142c14987897c4bf2abace478/raw/3ce9030d37ea60ff3f70ac6f1457e45ffb85493b/openapi.json"
EOF
kubectl apply -f test-activedoc-underscore.yaml

Expected to succeed (Failed condition status == false):

% oc get activedoc test-activedoc-underscore -o json | jq -r '.status.conditions | map(select(.type=="Failed"))'
[
  {
    "lastTransitionTime": "2026-09-11T07:14:29Z",
    "status": "False",
    "type": "Failed"
  }
]

If the name contains a bad character, it's expected to fail:

cat << 'EOF' > test-activedoc-bad.yaml
apiVersion: capabilities.3scale.net/v1beta1
kind: ActiveDoc
metadata:
  name: test-activedoc-bad
  annotations:
    insecure_skip_verify: "true"
spec:
  name: "Test ActiveDoc"
  systemName: "bad@name"
  activeDocOpenAPIRef:
    url: "https://gist.githubusercontent.com/borisurbanik/3dbc318142c14987897c4bf2abace478/raw/3ce9030d37ea60ff3f70ac6f1457e45ffb85493b/openapi.json"
EOF
kubectl apply -f test-activedoc-bad.yaml

Expected to show error:

The ActiveDoc "test-activedoc-bad" is invalid: spec.systemName: Invalid value: "bad@name": spec.systemName in body should match '^\w[\w\-/_]+$'

[briangallagher]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.65%. Comparing base (c59a4c8) to head (46126b8).
⚠️ Report is 16 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1191      +/-   ##
==========================================
+ Coverage   44.03%   44.65%   +0.62%     
==========================================
  Files         204      208       +4     
  Lines       20960    21235     +275     
==========================================
+ Hits         9230     9483     +253     
- Misses      10933    10952      +19     
- Partials      797      800       +3     

Flag	Coverage Δ
unit	44.65% <ø> (+0.62%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
apis/apps/v1alpha1 (u)	63.56% <ø> (ø)
apis/capabilities/v1alpha1 (u)	3.50% <ø> (ø)
apis/capabilities/v1beta1 (u)	20.21% <ø> (ø)
controllers (i)	12.59% <84.00%> (+0.51%)	⬆️
pkg (u)	64.26% <92.77%> (+0.56%)	⬆️

Files with missing lines	Coverage Δ
apis/capabilities/v1beta1/activedoc_types.go	5.00% <ø> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[tkan145]

Is there any reason why we want to remove the validation instead of fixing it to match what the system does?

[borisurbanik]

Is there any reason why we want to remove the validation instead of fixing it to match what the system does?

Yes, to make it consistent with all the other CRs that contain system name. Also validation rules in porta can change in the future to be more permissive.

The ask in JIRA was:

The system-name is 3scale usually also allows "_" inside systemName, so either the regex needs to be changed or removed (other resources like Product and Backend don't contain a regex at all).

The porta currently uses for validation following regex: ^\w[\w\-/_]+$ (https://github.com/3scale/porta/blame/4fb59a782bed6edfa198d111d9f490cd21b6e696/app/lib/system_name.rb#L15)

I have no objection to changing it to that if that's your preference.

[tkan145]

Also validation rules in porta can change in the future to be more permissive.

I don't think you can easily change it without breaking a bunch of things and I don't see it going to happen ever. Plus because the porta validation rules are fixed and known, we validate/false early and save an extra API calls. If needed we can add the same rules to other CRD(s)

[borisurbanik]

Also validation rules in porta can change in the future to be more permissive.

I don't think you can easily change it without breaking a bunch of things and I don't see it going to happen ever. Plus because the porta validation rules are fixed and known, we validate/false early and save an extra API calls. If needed we can add the same rules to other CRD(s)

Updated PR to match validation as discussed above. Please re-review.

[tkan145]

nit: underscore _ here is redundant since \w already includes it)

Additionally, this will cause an error if the system name consists of only a single character (rare), as the system previously required one or more characters but now requires at least two.

I won't block this

/lgtm
/approve