feat: add kube api linter in kagent

.github/workflows/ci.yaml

@@ -309,6 +309,23 @@ jobs:
           version: v2.11.3
           working-directory: go
 
+  api-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.26"
+          cache: true
+          cache-dependency-path: go/go.sum
+
+      - name: Run kube-api-linter
+        working-directory: go
+        run: make lint-api
+
   python-test:
     env:
       OPENAI_API_KEY: fake

Makefile

@@ -259,6 +259,10 @@ lint:
 	make -C go lint
 	make -C python lint
 
+.PHONY: lint-api
+lint-api:
+	make -C go lint-api
+
 .PHONY: push
 push: push-controller push-ui push-app push-kagent-adk push-golang-adk push-golang-adk-full
 

go/.custom-gcl.yaml

@@ -0,0 +1,6 @@
+version: v2.11.3
+name: golangci-kube-api-linter
+destination: ./tmp/bin/
+plugins:
+- module: 'sigs.k8s.io/kube-api-linter'
+  version: v0.0.0-20260206102632-39e3d06a2850

go/.golangci-kal.yml

@@ -0,0 +1,54 @@
+version: "2"
+run:
+  go: "1.26"
+  allow-parallel-runners: true
+linters:
+  default: none
+  enable:
+    - kubeapilinter
+  settings:
+    custom:
+      kubeapilinter:
+        type: module
+        description: KAL validates CRDs against Kubernetes API conventions.
+        settings:
+          linters:
+            enable:
+              - "conflictingmarkers"
+              - "duplicatemarkers"
+              - "nofloats"
+              - "optionalorrequired"
+              - "statussubresource"
+              - "uniquemarkers"
+              - "statusoptional"
+              - "nophase"
+              - "nonullable"
+              - "forbiddenmarkers"
+              - "nomaps"
+            disable:
+              - "*"
+          lintersConfig:
+            conflictingmarkers:
+              conflicts:
+              - name: "default_vs_required"
+                sets:
+                  - ["default", "kubebuilder:default"]
+                  - ["required", "kubebuilder:validation:Required", "k8s:required"]
+                description: "A field with a default value cannot be required"
+            forbiddenmarkers:
+              markers:
+                - identifier: "+kubebuilder:pruning:PreserveUnknownFields"
+                - identifier: "+kubebuilder:validation:XPreserveUnknownFields"
+                - identifier: "+kubebuilder:validation:items:XPreserveUnknownFields"
+                - identifier: "+kubebuilder:validation:EmbeddedResource"
+                - identifier: "+kubebuilder:validation:XEmbeddedResource"
+                - identifier: "+kubebuilder:validation:items:XEmbeddedResource"
+  exclusions:
+    generated: strict
+    paths:
+      - _test\.go
+      - zz_generated.*\.go$
+    rules:
+    - path: "./api/v1alpha.*"
+      linters:
+        - kubeapilinter

go/Makefile

@@ -55,6 +55,22 @@ lint-fix: golangci-lint ## Run golangci-lint with auto-fix.
 lint-config: golangci-lint ## Verify golangci-lint linter configuration.
 	$(GOLANGCI_LINT) config verify
 
+KAL_BIN ?= $(LOCALBIN)/golangci-kube-api-linter
+
+.PHONY: lint-api
+lint-api: $(KAL_BIN)
+	$(KAL_BIN) run --config .golangci-kal.yml ./api/v1alpha1/... ./api/v1alpha2/...
+
+.PHONY: lint-api-fix
+lint-api-fix: $(KAL_BIN)
+	$(KAL_BIN) run --fix --config .golangci-kal.yml ./api/v1alpha1/... ./api/v1alpha2/...
+
+$(KAL_BIN): golangci-lint
+	@mkdir -p $(LOCALBIN)
+	@echo "Building custom golangci-lint with kube-api-linter plugin..."
+	GOLANGCI_LINT_CUSTOM_CONFIG=.custom-gcl.yaml GOLANGCI_LINT_SKIP_BUILD=true GOLANGCI_LINT_OFFLINE=true $(GOLANGCI_LINT) custom
+	@mv tmp/bin/golangci-kube-api-linter $(KAL_BIN)
+
 .PHONY: govulncheck
 govulncheck: ## Run govulncheck.
 	$(call go-install-tool,bin/govulncheck,golang.org/x/vuln/cmd/govulncheck,latest)
@@ -99,6 +115,7 @@ core/bin/kagent-windows-amd64.exe.sha256: core/bin/kagent-windows-amd64.exe
 .PHONY: clean
 clean:
 	rm -f core/bin/kagent* && mkdir -p core/bin
+	rm -f $(LOCALBIN)/golangci-kube-api-linter*
 
 .PHONY: build
 build: core/bin/kagent-linux-amd64.sha256 core/bin/kagent-linux-arm64.sha256 core/bin/kagent-darwin-amd64.sha256 core/bin/kagent-darwin-arm64.sha256 core/bin/kagent-windows-amd64.exe.sha256

go/api/config/crd/bases/kagent.dev_agents.yaml

@@ -2258,14 +2258,10 @@ spec:
                           type: string
                       type: object
                     type:
-                      allOf:
-                      - enum:
-                        - McpServer
-                        - Agent
-                      - enum:
-                        - McpServer
-                        - Agent
                       description: ToolProviderType represents the tool provider type
+                      enum:
+                      - McpServer
+                      - Agent
                       type: string
                   type: object
                   x-kubernetes-validations:
@@ -2348,9 +2344,6 @@ spec:
               observedGeneration:
                 format: int64
                 type: integer
-            required:
-            - configHash
-            - observedGeneration
             type: object
         type: object
     served: true
@@ -9979,19 +9972,15 @@ spec:
                         type: array
                     type: object
                   runtime:
-                    allOf:
-                    - enum:
-                      - python
-                      - go
-                    - enum:
-                      - python
-                      - go
                     default: python
                     description: |-
                       Runtime specifies which ADK implementation to use for this agent.
                       - "python": Uses the Python ADK (default, slower startup, full feature set)
                       - "go": Uses the Go ADK (faster startup, most features supported)
                       The runtime determines both the container image and readiness probe configuration.
+                    enum:
+                    - python
+                    - go
                     type: string
                   stream:
                     description: |-
@@ -10138,15 +10127,11 @@ spec:
                             rule: '!has(self.requireApproval) || self.requireApproval.all(x,
                               has(self.toolNames) && x in self.toolNames)'
                         type:
-                          allOf:
-                          - enum:
-                            - McpServer
-                            - Agent
-                          - enum:
-                            - McpServer
-                            - Agent
                           description: ToolProviderType represents the tool provider
                             type
+                          enum:
+                          - McpServer
+                          - Agent
                           type: string
                       type: object
                       x-kubernetes-validations:
@@ -10474,18 +10459,12 @@ spec:
                     type: array
                 type: object
               type:
-                allOf:
-                - enum:
-                  - Declarative
-                  - BYO
-                - enum:
-                  - Declarative
-                  - BYO
                 default: Declarative
                 description: AgentType represents the agent type
+                enum:
+                - Declarative
+                - BYO
                 type: string
-            required:
-            - type
             type: object
             x-kubernetes-validations:
             - message: type must be specified
@@ -10558,8 +10537,6 @@ spec:
               observedGeneration:
                 format: int64
                 type: integer
-            required:
-            - observedGeneration
             type: object
         type: object
     served: true

go/api/config/crd/bases/kagent.dev_memories.yaml

@@ -86,8 +86,6 @@ spec:
                 enum:
                 - Pinecone
                 type: string
-            required:
-            - provider
             type: object
           status:
             description: MemoryStatus defines the observed state of Memory.
@@ -151,9 +149,6 @@ spec:
               observedGeneration:
                 format: int64
                 type: integer
-            required:
-            - conditions
-            - observedGeneration
             type: object
         type: object
     served: true

go/api/config/crd/bases/kagent.dev_modelconfigs.yaml

@@ -259,7 +259,6 @@ spec:
                 type: string
             required:
             - model
-            - provider
             type: object
             x-kubernetes-validations:
             - message: provider.openAI must be nil if the provider is not OpenAI
@@ -340,9 +339,6 @@ spec:
               observedGeneration:
                 format: int64
                 type: integer
-            required:
-            - conditions
-            - observedGeneration
             type: object
         type: object
     served: true
@@ -598,13 +594,10 @@ spec:
                         - audience
                         type: object
                       type:
-                        allOf:
-                        - enum:
-                          - GDCHServiceAccount
-                        - enum:
-                          - GDCHServiceAccount
                         description: TokenExchangeType identifies the token exchange
                           mechanism
+                        enum:
+                        - GDCHServiceAccount
                         type: string
                     required:
                     - type
@@ -683,7 +676,6 @@ spec:
                 type: object
             required:
             - model
-            - provider
             type: object
             x-kubernetes-validations:
             - message: provider.openAI must be nil if the provider is not OpenAI
@@ -813,9 +805,6 @@ spec:
                   this model config detect changes to these secrets and restart if
                   necessary.
                 type: string
-            required:
-            - conditions
-            - observedGeneration
             type: object
         type: object
     served: true

go/api/config/crd/bases/kagent.dev_remotemcpservers.yaml

@@ -260,9 +260,6 @@ spec:
                   Important: Run "make" to regenerate code after modifying this file
                 format: int64
                 type: integer
-            required:
-            - conditions
-            - observedGeneration
             type: object
         type: object
     served: true

go/api/config/crd/bases/kagent.dev_sandboxagents.yaml

@@ -7629,19 +7629,15 @@ spec:
                         type: array
                     type: object
                   runtime:
-                    allOf:
-                    - enum:
-                      - python
-                      - go
-                    - enum:
-                      - python
-                      - go
                     default: python
                     description: |-
                       Runtime specifies which ADK implementation to use for this agent.
                       - "python": Uses the Python ADK (default, slower startup, full feature set)
                       - "go": Uses the Go ADK (faster startup, most features supported)
                       The runtime determines both the container image and readiness probe configuration.
+                    enum:
+                    - python
+                    - go
                     type: string
                   stream:
                     description: |-
@@ -7788,15 +7784,11 @@ spec:
                             rule: '!has(self.requireApproval) || self.requireApproval.all(x,
                               has(self.toolNames) && x in self.toolNames)'
                         type:
-                          allOf:
-                          - enum:
-                            - McpServer
-                            - Agent
-                          - enum:
-                            - McpServer
-                            - Agent
                           description: ToolProviderType represents the tool provider
                             type
+                          enum:
+                          - McpServer
+                          - Agent
                           type: string
                       type: object
                       x-kubernetes-validations:
@@ -8124,18 +8116,12 @@ spec:
                     type: array
                 type: object
               type:
-                allOf:
-                - enum:
-                  - Declarative
-                  - BYO
-                - enum:
-                  - Declarative
-                  - BYO
                 default: Declarative
                 description: AgentType represents the agent type
+                enum:
+                - Declarative
+                - BYO
                 type: string
-            required:
-            - type
             type: object
             x-kubernetes-validations:
             - message: type must be specified
@@ -8208,8 +8194,6 @@ spec:
               observedGeneration:
                 format: int64
                 type: integer
-            required:
-            - observedGeneration
             type: object
         type: object
     served: true

go/api/config/crd/bases/kagent.dev_toolservers.yaml

@@ -321,9 +321,6 @@ spec:
                   Important: Run "make" to regenerate code after modifying this file
                 format: int64
                 type: integer
-            required:
-            - conditions
-            - observedGeneration
             type: object
         type: object
     served: true