---
id: w6/m9/t004
title: "CRD validation markers for Repo/Branch/RootDir in lego/types + make manifests generate"
worker: worker6
status: done
estimate: 45m
depends_on: []
---

## Objective

Add `+kubebuilder:validation:*` markers to `App.Spec.{Repo,Branch,RootDir}` so the kube API server rejects bad values from every writer (bex-api and hand-applied CRs alike), per `w6/007`.

## Context

- `lego/types/v1alpha1/app_types.go` — `Repo`/`Branch`/`RootDir` currently carry no validation markers, unlike `Type`/`Builder`/`Replicas`/`Port`.
- bex-api's own `ValidRepo`/`ValidGitRef`/`ValidRootDir` validators (from `w6/m6`) only cover the bex-api entry points, not hand-applied CRs (`scripts/app-apply.sh`, `examples/whoami-app.yaml`, direct `kubectl apply`).

## Steps

1. Add markers: `Repo` — `+kubebuilder:validation:Pattern="^(https?://|ssh://|git@)"`, `+kubebuilder:validation:MaxLength=2048`; `Branch` — `+kubebuilder:validation:Pattern="^[A-Za-z0-9][A-Za-z0-9._/@+-]*$"`, `+kubebuilder:validation:MaxLength=255`; `RootDir` — `+kubebuilder:validation:MaxLength=512`.
2. Run `make manifests generate` from `lego/operator/` to regenerate `config/crd/bases/app.bex.co_apps.yaml`.
3. Check the CRD change against existing CRs (via envtest or a diff) to confirm no currently-valid CR would be rejected on update.

## Files

- `lego/types/v1alpha1/app_types.go`
- `lego/operator/config/crd/bases/app.bex.co_apps.yaml` (generated)

## Acceptance criteria

- [ ] A hand-applied `App` CR with a malformed `repo`/`branch`/`rootDir` is rejected by the API server.
- [ ] Existing valid example CRs (`examples/whoami-app.yaml`, `examples/hello-go/`) still apply cleanly.

## Out of scope

- Path-traversal (`..`) rejection in `RootDir` — stays the Go validator's job (awkward in JSON schema); the CRD marker only bounds length.
