<p>I'm using the Kubernetes golang operator sdk to implement an operator that manages RabbitMQ queues. I'm wondering if there's a way for k8s to enforce immutability of particular spec fields on my custom resource. I have the following golang struct which represents a rabbitMQ queue and some parameters to have it bind to a rabbitMQ exchange:</p>

<pre class="lang-golang prettyprint-override"><code>type RmqQueueSpec struct {
    VHost string `json:"vhost,required"`
    Exchange string `json:"exchange,required"`
    RoutingKey string `json:"routingKey"`
    SecretConfig map[string]string `json:"secretConfig"`
}
</code></pre>

<p>The reason why I want immutability, specifically for the <code>VHost</code> field, is because it's a parameter that's used to namespace a queue in rabbitMQ. If it were changed for an existing deployed queue, the k8s reconciler will fail to query rabbitMQ for the intended queue since it will be querying with a different vhost (effectively a different namespace), which could cause the creation of a new queue or an update of the wrong queue.</p>

<p>There are a few alternatives that I'm considering such as using the required ObjectMeta.Name field to contain both the concatenated vhost and the queuename to ensure that they are immutable for a deployed queue. Or somehow caching older specs within the operator (haven't figured out exactly how to do this yet) and doing a comparison of the old and current spec in the reconciler returning an error if <code>VHost</code> changes. However neither of these approaches seem ideal. Ideally if the operator framework could enforce immutability on the <code>VHost</code> field, that would be a simple approach to handling this.</p>

wangdrew
<p>This validation is possible by using the <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook" rel="nofollow noreferrer">ValidatingAdmissionWebhook</a> with future support coming via CRD's OpenAPI validation.</p>
<ul>
<li><a href="https://github.com/operator-framework/operator-sdk/issues/1587" rel="nofollow noreferrer">https://github.com/operator-framework/operator-sdk/issues/1587</a></li>
<li><a href="https://github.com/kubernetes/kubernetes/issues/65973" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/65973</a></li>
</ul>
