First pass

pkg/apis/v1alpha1/cluster_supply_chain_validations.go

@@ -16,6 +16,7 @@ package v1alpha1
 
 import (
 	"fmt"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 func (c *ClusterSupplyChain) validateNewState() error {
@@ -29,6 +30,10 @@ func (c *ClusterSupplyChain) validateNewState() error {
 		return err
 	}
 
+	if err := validateSelectors(c.Spec.Selectors); err != nil {
+		return err
+	}
+
 	for _, resource := range c.Spec.Resources {
 		if _, ok := names[resource.Name]; ok {
 			return fmt.Errorf("duplicate resource name [%s] found", resource.Name)
@@ -127,6 +132,29 @@ func (c *ClusterSupplyChain) validateResourceRefs(references []ResourceReference
 	return nil
 }
 
+func validateSelectors(selectors Selectors) error {
+	var err error
+
+	labelSelector := &metav1.LabelSelector{
+		MatchLabels:      selectors.Selector,
+		MatchExpressions: selectors.SelectorMatchExpressions,
+	}
+
+	_, err = metav1.LabelSelectorAsSelector(labelSelector)
+	if err != nil {
+		return fmt.Errorf("selectorMatchExpressions or selectors are not valid: %w", err)
+	}
+
+	if len(selectors.SelectorMatchFields) != 0 {
+		err = validateFieldSelectorRequirements(selectors.SelectorMatchFields, ValidWorkloadPaths, ValidWorkloadPrefixes)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 func validateSupplyChainTemplateRef(ref SupplyChainTemplateReference) error {
 	if ref.Name != "" && len(ref.Options) > 0 {
 		return fmt.Errorf("exactly one of templateRef.Name or templateRef.Options must be specified, found both")