From 7bb9c815ebf56789d6718a820d1e877ab42d35ba Mon Sep 17 00:00:00 2001 From: Michael Kanchuker Date: Thu, 16 Jul 2026 21:38:37 +0300 Subject: [PATCH] docs: document name-only secret references Co-authored-by: Cursor --- references/generator-yaml-reference.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/references/generator-yaml-reference.md b/references/generator-yaml-reference.md index 7b0cfe1..8606e84 100644 --- a/references/generator-yaml-reference.md +++ b/references/generator-yaml-reference.md @@ -90,6 +90,19 @@ deletable: If the resource is NOT in an allowed state, the delete is requeued. +### Spec CEL Validations + +Adds kubebuilder `XValidation` markers to the generated resource Spec: + +```yaml +spec_validations: + - rule: "!has(self.importFrom) || !has(self.certificate)" + message: "importFrom and certificate are mutually exclusive" +``` + +Both `rule` and `message` are required. Rules use Kubernetes CEL syntax and +are enforced by CRD admission. + ### Tags ```yaml @@ -215,6 +228,7 @@ operations: | `is_arn` | bool | Override default ARN field detection | | `is_attribute` | bool | Field is part of an Attributes map (SNS/SQS pattern) | | `is_secret` | bool | Field becomes a SecretKeyReference | +| `is_secret_reference` | bool | Field becomes a name/namespace-only SecretReference when the controller owns the data-key convention | ### Immutability