Restrict major version annotation to FeatureGate and CustomResourceDefinition

Author: JoelSpeed

pkg/manifest/manifest.go

@@ -235,7 +235,7 @@ func checkFeatureGates(enabledGates sets.Set[string], annotations map[string]str
 }
 
 // checkMajorVersion validates if manifest should be included based on major version requirements
-func checkMajorVersion(clusterMajorVersion uint64, annotations map[string]string) error {
+func checkMajorVersion(gvk schema.GroupVersionKind, clusterMajorVersion uint64, annotations map[string]string) error {
 	if annotations == nil {
 		return nil // No annotations, include by default
 	}
@@ -244,6 +244,11 @@ func checkMajorVersion(clusterMajorVersion uint64, annotations map[string]string
 		return nil // No requirements, include by default
 	}
 
+	if !isFeatureGate(gvk) && !isCustomResource(gvk) {
+		// Has a requirement, but is not of the expected kind
+		return fmt.Errorf("major version filtering is only supported for feature gates and custom resources")
+	}
+
 	requirements := strings.Split(majorVersionRequirements, ",")
 	includedVersions := sets.New[uint64]()
 	excludedVersions := sets.New[uint64]()
@@ -338,7 +343,7 @@ func (m *Manifest) IncludeAllowUnknownCapabilities(excludeIdentifier *string, re
 
 	// Major version filtering
 	if majorVersion != nil {
-		err := checkMajorVersion(*majorVersion, annotations)
+		err := checkMajorVersion(m.GVK, *majorVersion, annotations)
 		if err != nil {
 			return err
 		}
@@ -543,3 +548,11 @@ func addIfNotDuplicateResource(manifest Manifest, resourceIds map[resourceId]boo
 	}
 	return fmt.Errorf("duplicate resource: (%s)", manifest.id)
 }
+
+func isFeatureGate(gvk schema.GroupVersionKind) bool {
+	return gvk.Group == "config.openshift.io" && gvk.Kind == "FeatureGate"
+}
+
+func isCustomResource(gvk schema.GroupVersionKind) bool {
+	return gvk.Group == "apiextensions.k8s.io" && gvk.Kind == "CustomResourceDefinition"
+}

pkg/manifest/manifest_test.go

@@ -1380,6 +1380,7 @@ func TestMajorVersionFiltering(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			manifest := createTestManifest(tt.annotations)
+			manifest.GVK = schema.GroupVersionKind{Group: "config.openshift.io", Kind: "FeatureGate"}
 
 			// Test through the Include method which calls checkMajorVersion
 			err := manifest.Include(nil, nil, nil, nil, nil, nil, tt.clusterMajorVersion)
@@ -1449,6 +1450,7 @@ func TestMajorVersionFilteringInteractionWithOtherFilters(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			manifest := createTestManifest(tt.annotations)
+			manifest.GVK = schema.GroupVersionKind{Group: "config.openshift.io", Kind: "FeatureGate"}
 
 			err := manifest.Include(nil, tt.requiredFeatureSet, nil, nil, nil, tt.enabledFeatureGates, tt.clusterMajorVersion)