🐛 Prevent removal of ClusterObjectSet completedAt once set

The field-level CEL transition rule on status.completedAt is skipped when
the field is absent from an update, so a status write that omits it would
clear the timestamp and let a later reconciliation record a different one,
breaking the set-once guarantee. Add a parent-level transition rule on the
status that rejects removal once the field is set, and cover the removal
case with a validation test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Per G. da Silva <pegoncal@redhat.com>

Author: Per G. da Silva

api/v1/clusterobjectset_types.go

@@ -485,6 +485,12 @@ const (
 )
 
 // ClusterObjectSetStatus defines the observed state of a ClusterObjectSet.
+//
+// The completedAt removal guard lives here at the parent level because a
+// field-level transition rule is skipped when the field is absent from an
+// update, which would otherwise allow the timestamp to be cleared and re-set.
+//
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.completedAt) || has(self.completedAt)",message="completedAt cannot be removed once set"
 type ClusterObjectSetStatus struct {
 	// conditions is an optional list of status conditions describing the state of the
 	// ClusterObjectSet.

api/v1/validation_test.go

@@ -211,3 +211,28 @@ func TestClusterObjectSetCompletedAtImmutable(t *testing.T) {
 	err := c.Status().Update(t.Context(), cos)
 	require.True(t, errors.IsInvalid(err), "expected update to fail as invalid, but got: %v", err)
 }
+
+func TestClusterObjectSetCompletedAtCannotBeRemoved(t *testing.T) {
+	c := newClient(t)
+
+	cos := &ClusterObjectSet{
+		ObjectMeta: metav1.ObjectMeta{Name: "cos-completedat-noremove"},
+		Spec: ClusterObjectSetSpec{
+			Revision:            1,
+			CollisionProtection: CollisionProtectionPrevent,
+			LifecycleState:      ClusterObjectSetLifecycleStateActive,
+		},
+	}
+	require.NoError(t, c.Create(t.Context(), cos))
+
+	// Set completedAt once.
+	cos.Status.CompletedAt = metav1.NewTime(time.Date(2022, 1, 1, 0, 0, 0, 0, time.UTC))
+	require.NoError(t, c.Status().Update(t.Context(), cos))
+
+	// Removing completedAt once set must be rejected. The field-level transition
+	// rule is skipped when the field is absent from the update, so a parent-level
+	// rule must reject its removal.
+	cos.Status.CompletedAt = metav1.Time{}
+	err := c.Status().Update(t.Context(), cos)
+	require.True(t, errors.IsInvalid(err), "expected removal to fail as invalid, but got: %v", err)
+}

applyconfigurations/api/v1/clusterobjectsetstatus.go

@@ -672,6 +672,9 @@ spec:
                 - message: observedPhases is immutable
                   rule: self == oldSelf || oldSelf.size() == 0
             type: object
+            x-kubernetes-validations:
+            - message: completedAt cannot be removed once set
+              rule: '!has(oldSelf.completedAt) || has(self.completedAt)'
         type: object
     served: true
     storage: true

helm/olmv1/base/operator-controller/crd/experimental/olm.operatorframework.io_clusterobjectsets.yaml

@@ -2028,6 +2028,9 @@ spec:
                 - message: observedPhases is immutable
                   rule: self == oldSelf || oldSelf.size() == 0
             type: object
+            x-kubernetes-validations:
+            - message: completedAt cannot be removed once set
+              rule: '!has(oldSelf.completedAt) || has(self.completedAt)'
         type: object
     served: true
     storage: true

manifests/experimental-e2e.yaml

@@ -1989,6 +1989,9 @@ spec:
                 - message: observedPhases is immutable
                   rule: self == oldSelf || oldSelf.size() == 0
             type: object
+            x-kubernetes-validations:
+            - message: completedAt cannot be removed once set
+              rule: '!has(oldSelf.completedAt) || has(self.completedAt)'
         type: object
     served: true
     storage: true