verify-crds script now verifies that the CRDs don't contain status field

This is necessary because some CD tools don't accept resource configs with predefined status fields, but controllergen currently adds this field when a CRD yaml is generated

Signed-off-by: irbekrm <irbekrm@gmail.com>

hack/BUILD.bazel

@@ -12,6 +12,8 @@ GOFMT = "@go_sdk//:bin/gofmt"
 
 JQ = "//hack/bin:jq"
 
+YQ = "//hack/bin:yq"
+
 CONTROLLER_GEN = "@io_k8s_sigs_controller_tools//cmd/controller-gen"
 
 # General repo verification targets
@@ -252,11 +254,13 @@ sh_test(
         "$(location :update-crds)",
         "$(location %s)" % GO,
         "$(location %s)" % CONTROLLER_GEN,
+        "$(location %s)" % YQ,
     ],
     data = [
         ":update-crds",
         GO,
         CONTROLLER_GEN,
+        YQ,
         "@//:all-srcs",
     ],
 )

hack/bin/deps.bzl

@@ -268,4 +268,4 @@ def install_yq():
         executable = 1,
         sha256 = "6b891fd5bb13820b2f6c1027b613220a690ce0ef4fc2b6c76ec5f643d5535e61",
         urls = ["https://github.com/mikefarah/yq/releases/download/v4.11.2/yq_linux_amd64"],
-    )
+    )

hack/verify-crds.sh

@@ -63,3 +63,20 @@ if [[ -n "${diff}" ]]; then
   exit 1
 fi
 echo "SUCCESS: generated CRDs up-to-date"
+
+# Verify that CRDs don't contain status fields as that causes issues when they
+# are managed by some CD tools. This check is necessary because currently
+# controller-gen adds a status field that needs to be removed manually.
+# See https://github.com/jetstack/cert-manager/pull/4379 for context
+crdPath="${tmpfiles}/deploy/crds"
+yq=$(realpath "$4")
+
+echo "Verifying that CRDs don't contain .status fields..."
+for file in ${crdPath}/*.yaml; do
+  name=$($yq e '.metadata.name' $file)
+  echo "Verifying that the CRD for $name does not contain status field.."
+  # Exit 1 if status is non-null
+  $yq e --exit-status=1 '.status==null' $file
+done
+
+echo "SUCCESS: generated CRDs don't contain any status fields"