Kubernetes Validation Notes

Kubernetes-standard label and annotation format checks, exposed as notes. Kubernetes already enforces this format at the API server — these notes expose the same check so a validation.rules entry can gate on it directly, at admission time, with an Orkestra-native message instead of the API server’s raw rejection, and so ork simulate (which doesn’t run full structural schema validation) can catch it too.

Reference

Note	Description
`isValidLabelValue`	Report whether a string is a syntactically valid Kubernetes label value: max 63 characters, alphanumeric, may contain `-`, `_`, `.
`isValidLabelKey`	Report whether a string is a syntactically valid Kubernetes label key: `[prefix/]name` — `name` is alphanumeric (max 63 chars, may contain `-`, `_`, `.
`isValidAnnotationKey`	Report whether a string is a syntactically valid Kubernetes annotation key — the same `[prefix/]name` format as a label key.
`isDNS1123Subdomain`	Report whether a string is a syntactically valid DNS-1123 subdomain: lowercase alphanumeric segments (may contain `-`) separated by `.

Examples

# isValidLabelValue
validation:
  rules:
    - field: "{{ isValidLabelValue (getLabel . \"team\") }}"
      equals: "true"
      message: "Team label must be a valid Kubernetes label value"
      action: deny
{{ isValidLabelValue "team-payments" }}  → true
{{ isValidLabelValue ""              }}  → true
{{ isValidLabelValue "team payments" }}  → false
{{ isValidLabelValue "-leading-dash" }}  → false

# isValidLabelKey
validation:
  rules:
    - field: "{{ isValidLabelKey .spec.customLabelKey }}"
      equals: "true"
      message: "spec.customLabelKey is not a valid Kubernetes label key"
      action: deny
{{ isValidLabelKey "tier"                     }}  → true
{{ isValidLabelKey "platform.myorg.io/tier"   }}  → true
{{ isValidLabelKey "bad key"                  }}  → false

# isValidAnnotationKey
validation:
  rules:
    - field: "{{ isValidAnnotationKey .spec.customAnnotationKey }}"
      equals: "true"
      message: "spec.customAnnotationKey is not a valid Kubernetes annotation key"
      action: deny
{{ isValidAnnotationKey "platform.myorg.io/jira-ticket" }}  → true
{{ isValidAnnotationKey "bad key"                       }}  → false

# isDNS1123Subdomain
validation:
  rules:
    - field: "{{ isDNS1123Subdomain .spec.hostname }}"
      equals: "true"
      message: "spec.hostname must be a valid DNS subdomain"
      action: deny
{{ isDNS1123Subdomain "my-app.example.com" }}  → true
{{ isDNS1123Subdomain "My_App"             }}  → false
{{ isDNS1123Subdomain ""                   }}  → false