Add CheckObjectSupport validator with unit tests

Add a validator that checks non-CRD and non-CSV bundle objects are of
kinds supported by the registry+v1 standard, using operator-registry's

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Per G. da Silva <pegoncal@redhat.com>

Author: Per G. da Silva

internal/operator-controller/rukpak/render/registryv1/registryv1.go

@@ -29,6 +29,7 @@ var BundleValidator = render.BundleValidator{
 	validators.CheckConversionWebhookCRDReferenceUniqueness,
 	validators.CheckConversionWebhooksReferenceOwnedCRDs,
 	validators.CheckWebhookRules,
+	validators.CheckObjectSupport,
 }
 
 // ResourceGenerators a slice of ResourceGenerators required to generate plain resource manifests for

internal/operator-controller/rukpak/render/registryv1/registryv1_test.go

@@ -34,6 +34,7 @@ func Test_BundleValidatorHasAllValidationFns(t *testing.T) {
 		validators.CheckConversionWebhookCRDReferenceUniqueness,
 		validators.CheckConversionWebhooksReferenceOwnedCRDs,
 		validators.CheckWebhookRules,
+		validators.CheckObjectSupport,
 	}
 	actualValidationFns := registryv1.BundleValidator
 

internal/operator-controller/rukpak/render/registryv1/validators/validator.go

@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/validation"
 
 	"github.com/operator-framework/api/pkg/operators/v1alpha1"
+	regv1bundle "github.com/operator-framework/operator-registry/pkg/lib/bundle"
 
 	"github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/bundle"
 )
@@ -348,3 +349,16 @@ func CheckWebhookRules(rv1 *bundle.RegistryV1) []error {
 	}
 	return errs
 }
+
+// CheckObjectSupport checks that the non-CRD and non-CSV bundle objects are supported by the
+// registry+v1 standard
+func CheckObjectSupport(rv1 *bundle.RegistryV1) []error {
+	var errs []error
+	for _, obj := range rv1.Others {
+		kind := obj.GetObjectKind().GroupVersionKind().Kind
+		if ok, _ := regv1bundle.IsSupported(kind); !ok {
+			errs = append(errs, fmt.Errorf("unsupported resource %q with kind %q", obj.GetName(), kind))
+		}
+	}
+	return errs
+}

internal/operator-controller/rukpak/render/registryv1/validators/validator_test.go

@@ -8,6 +8,8 @@ import (
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	"github.com/operator-framework/api/pkg/operators/v1alpha1"
 
@@ -1171,3 +1173,82 @@ func Test_CheckWebhookNameIsDNS1123SubDomain(t *testing.T) {
 		})
 	}
 }
+
+func newUnstructuredObject(gvk schema.GroupVersionKind, name string) unstructured.Unstructured {
+	obj := unstructured.Unstructured{}
+	obj.SetGroupVersionKind(gvk)
+	obj.SetName(name)
+	return obj
+}
+
+func Test_CheckObjectSupport(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		bundle       *bundle.RegistryV1
+		expectedErrs []error
+	}{
+		{
+			name:         "accepts bundles with no other objects",
+			bundle:       &bundle.RegistryV1{},
+			expectedErrs: nil,
+		},
+		{
+			name: "accepts bundles with supported object kinds",
+			bundle: &bundle.RegistryV1{
+				Others: []unstructured.Unstructured{
+					newUnstructuredObject(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Secret"}, "my-secret"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ConfigMap"}, "my-configmap"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ServiceAccount"}, "my-sa"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Service"}, "my-service"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "ClusterRole"}, "my-clusterrole"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "ClusterRoleBinding"}, "my-clusterrolebinding"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "Role"}, "my-role"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "RoleBinding"}, "my-rolebinding"),
+				},
+			},
+			expectedErrs: nil,
+		},
+		{
+			name: "rejects bundles with unsupported object kinds",
+			bundle: &bundle.RegistryV1{
+				Others: []unstructured.Unstructured{
+					newUnstructuredObject(schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"}, "my-deployment"),
+				},
+			},
+			expectedErrs: []error{
+				errors.New(`unsupported resource "my-deployment" with kind "Deployment"`),
+			},
+		},
+		{
+			name: "reports errors for each unsupported object",
+			bundle: &bundle.RegistryV1{
+				Others: []unstructured.Unstructured{
+					newUnstructuredObject(schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"}, "my-deployment"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "StatefulSet"}, "my-statefulset"),
+				},
+			},
+			expectedErrs: []error{
+				errors.New(`unsupported resource "my-deployment" with kind "Deployment"`),
+				errors.New(`unsupported resource "my-statefulset" with kind "StatefulSet"`),
+			},
+		},
+		{
+			name: "accepts supported objects and rejects unsupported objects in the same bundle",
+			bundle: &bundle.RegistryV1{
+				Others: []unstructured.Unstructured{
+					newUnstructuredObject(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ConfigMap"}, "my-configmap"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "batch", Version: "v1", Kind: "Job"}, "my-job"),
+					newUnstructuredObject(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Secret"}, "my-secret"),
+				},
+			},
+			expectedErrs: []error{
+				errors.New(`unsupported resource "my-job" with kind "Job"`),
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := validators.CheckObjectSupport(tc.bundle)
+			require.Equal(t, tc.expectedErrs, errs)
+		})
+	}
+}