test: kubectl-validate manifests in presubmit

Signed-off-by: Ernest Wong <[email protected]>

Author: chewong

Makefile

@@ -158,7 +158,7 @@ verify: vet fmt-verify manifests generate ci-lint verify-all
 
 # Run static analysis.
 .PHONY: verify-all
-verify-all:
+verify-all: kubectl-validate
 	hack/verify-all.sh -v
 
 ##@ Build
@@ -347,13 +347,15 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest
 GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
 HELM = $(PROJECT_DIR)/bin/helm
 YQ = $(PROJECT_DIR)/bin/yq
+KUBECTL_VALIDATE = $(PROJECT_DIR)/bin/kubectl-validate
 
 ## Tool Versions
 KUSTOMIZE_VERSION ?= v5.4.3
 CONTROLLER_TOOLS_VERSION ?= v0.16.1
 ENVTEST_VERSION ?= release-0.19
 GOLANGCI_LINT_VERSION ?= v1.62.2
 HELM_VERSION ?= v3.17.1
+KUBECTL_VALIDATE_VERSION ?= v0.0.4
 
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
@@ -383,6 +385,11 @@ yq: ## Download yq locally if necessary.
 helm: ## Download helm locally if necessary.
 	GOBIN=$(PROJECT_DIR)/bin GO111MODULE=on go install helm.sh/helm/v3/cmd/helm@$(HELM_VERSION)
 
+.PHONY: kubectl-validate
+kubectl-validate: $(KUBECTL_VALIDATE) ## Download kubectl-validate locally if necessary.
+$(KUBECTL_VALIDATE): $(LOCALBIN)
+	$(call go-install-tool,$(KUBECTL_VALIDATE),sigs.k8s.io/kubectl-validate,$(KUBECTL_VALIDATE_VERSION))
+
 # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
 # $1 - target path with name of binary
 # $2 - package url which can be installed

hack/verify-manifests.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+# Copyright 2025 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")/..
+
+TEMP_DIR=$(mktemp -d)
+trap "rm -rf ${TEMP_DIR}" EXIT
+
+cp ${SCRIPT_ROOT}/config/crd/bases/* "${TEMP_DIR}/"
+
+# Download external CRDs for validation
+curl -sL https://raw.githubusercontent.com/GoogleCloudPlatform/gke-gateway-api/refs/tags/v1.4.0/config/crd/networking.gke.io_gcpbackendpolicies.yaml -o "${TEMP_DIR}/networking.gke.io_gcpbackendpolicies.yaml"
+curl -sL https://raw.githubusercontent.com/GoogleCloudPlatform/gke-gateway-api/refs/tags/v1.4.0/config/crd/networking.gke.io_healthcheckpolicies.yaml -o "${TEMP_DIR}/networking.gke.io_healthcheckpolicies.yaml"
+curl -sL https://raw.githubusercontent.com/istio/istio/refs/tags/1.26.2/manifests/charts/base/files/crd-all.gen.yaml -o "${TEMP_DIR}/istio_crds.yaml"
+
+${SCRIPT_ROOT}/bin/kubectl-validate "${TEMP_DIR}"
+${SCRIPT_ROOT}/bin/kubectl-validate ${SCRIPT_ROOT}/config/manifests --local-crds "${TEMP_DIR}"