feat: kubesphere 4.0 (#6115)

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

---------

Signed-off-by: ci-bot <ci-bot@kubesphere.io>
Co-authored-by: ks-ci-bot <ks-ci-bot@example.com>
Co-authored-by: joyceliu <joyceliu@yunify.com>

vendor/k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1/generated.proto

@@ -107,12 +107,12 @@ message CustomResourceColumnDefinition {
 // CustomResourceConversion describes how to convert different versions of a CR.
 message CustomResourceConversion {
   // strategy specifies how custom resources are converted between versions. Allowed values are:
-  // - `None`: The converter only change the apiVersion and would not touch any other field in the custom resource.
-  // - `Webhook`: API Server will call to an external webhook to do the conversion. Additional information
+  // - `"None"`: The converter only change the apiVersion and would not touch any other field in the custom resource.
+  // - `"Webhook"`: API Server will call to an external webhook to do the conversion. Additional information
   //   is needed for this option. This requires spec.preserveUnknownFields to be false, and spec.conversion.webhook to be set.
   optional string strategy = 1;
 
-  // webhook describes how to call the conversion webhook. Required when `strategy` is set to `Webhook`.
+  // webhook describes how to call the conversion webhook. Required when `strategy` is set to `"Webhook"`.
   // +optional
   optional WebhookConversion webhook = 2;
 }
@@ -658,6 +658,18 @@ message ValidationRule {
   //   - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values
   //     are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with
   //     non-intersecting keys are appended, retaining their partial order.
+  //
+  // If `rule` makes use of the `oldSelf` variable it is implicitly a
+  // `transition rule`.
+  //
+  // By default, the `oldSelf` variable is the same type as `self`.
+  // When `optionalOldSelf` is true, the `oldSelf` variable is a CEL optional
+  //  variable whose value() is the same type as `self`.
+  // See the documentation for the `optionalOldSelf` field for details.
+  //
+  // Transition rules by default are applied only on UPDATE requests and are
+  // skipped if an old value could not be found. You can opt a transition
+  // rule into unconditional evaluation by setting `optionalOldSelf` to true.
   optional string rule = 1;
 
   // Message represents the message displayed when validation fails. The message is required if the Rule contains
@@ -665,6 +677,57 @@ message ValidationRule {
   // If unset, the message is "failed rule: {Rule}".
   // e.g. "must be a URL with the host matching spec.host"
   optional string message = 2;
+
+  // MessageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.
+  // Since messageExpression is used as a failure message, it must evaluate to a string.
+  // If both message and messageExpression are present on a rule, then messageExpression will be used if validation
+  // fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
+  // as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string
+  // that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and
+  // the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged.
+  // messageExpression has access to all the same variables as the rule; the only difference is the return type.
+  // Example:
+  // "x must be less than max ("+string(self.max)+")"
+  // +optional
+  optional string messageExpression = 3;
+
+  // reason provides a machine-readable validation failure reason that is returned to the caller when a request fails this validation rule.
+  // The HTTP status code returned to the caller will match the reason of the reason of the first failed validation rule.
+  // The currently supported reasons are: "FieldValueInvalid", "FieldValueForbidden", "FieldValueRequired", "FieldValueDuplicate".
+  // If not set, default to use "FieldValueInvalid".
+  // All future added reasons must be accepted by clients when reading this value and unknown reasons should be treated as FieldValueInvalid.
+  // +optional
+  optional string reason = 4;
+
+  // fieldPath represents the field path returned when the validation fails.
+  // It must be a relative JSON path (i.e. with array notation) scoped to the location of this x-kubernetes-validations extension in the schema and refer to an existing field.
+  // e.g. when validation checks if a specific attribute `foo` under a map `testMap`, the fieldPath could be set to `.testMap.foo`
+  // If the validation checks two lists must have unique attributes, the fieldPath could be set to either of the list: e.g. `.testList`
+  // It does not support list numeric index.
+  // It supports child operation to refer to an existing field currently. Refer to [JSONPath support in Kubernetes](https://kubernetes.io/docs/reference/kubectl/jsonpath/) for more info.
+  // Numeric index of array is not supported.
+  // For field name which contains special characters, use `['specialName']` to refer the field name.
+  // e.g. for attribute `foo.34$` appears in a list `testList`, the fieldPath could be set to `.testList['foo.34$']`
+  // +optional
+  optional string fieldPath = 5;
+
+  // optionalOldSelf is used to opt a transition rule into evaluation
+  // even when the object is first created, or if the old object is
+  // missing the value.
+  //
+  // When enabled `oldSelf` will be a CEL optional whose value will be
+  // `None` if there is no old value, or when the object is initially created.
+  //
+  // You may check for presence of oldSelf using `oldSelf.hasValue()` and
+  // unwrap it after checking using `oldSelf.value()`. Check the CEL
+  // documentation for Optional types for more information:
+  // https://pkg.go.dev/github.com/google/cel-go/cel#OptionalTypes
+  //
+  // May not be set unless `oldSelf` is used in `rule`.
+  //
+  // +featureGate=CRDValidationRatcheting
+  // +optional
+  optional bool optionalOldSelf = 6;
 }
 
 // WebhookClientConfig contains the information to make a TLS connection with the webhook.