Add a Make target that runs crd-schema-checker

This tool estimates the total and relative cost of CEL validation rules.

See: https://github.com/openshift/crd-schema-checker

Author: cbandy

Makefile

@@ -14,6 +14,7 @@ CONTROLLER ?= $(GO) tool sigs.k8s.io/controller-tools/cmd/controller-gen
 # Run tests using the latest tools.
 CHAINSAW ?= $(GO) run github.com/kyverno/chainsaw@latest
 CHAINSAW_TEST ?= $(CHAINSAW) test
+CRD_CHECKER ?= $(GO) run github.com/openshift/crd-schema-checker/cmd/crd-schema-checker@latest
 ENVTEST ?= $(GO) run sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
 KUTTL ?= $(GO) run github.com/kudobuilder/kuttl/cmd/kubectl-kuttl@latest
 KUTTL_TEST ?= $(KUTTL) test
@@ -148,6 +149,12 @@ check: ## Run basic go tests with coverage output
 check: get-pgmonitor
 	QUERIES_CONFIG_DIR="$(CURDIR)/${QUERIES_CONFIG_DIR}" $(GO_TEST) -cover ./...
 
+# Informational only; no criteria to enforce at this time.
+.PHONY: check-crd
+check-crd:
+	$(foreach CRD, $(wildcard config/crd/bases/*.yaml), \
+		$(CRD_CHECKER) check-manifests --new-crd-filename '$(CRD)' 2>&1 | awk -f hack/check-manifests.awk $(newline))
+
 # Available versions: curl -s 'https://storage.googleapis.com/kubebuilder-tools/' | grep -o '<Key>[^<]*</Key>'
 # - KUBEBUILDER_ATTACH_CONTROL_PLANE_OUTPUT=true
 .PHONY: check-envtest
@@ -254,3 +261,9 @@ generate-rbac: ## Generate RBAC
 		) rbac:roleName='postgres-operator' $(\
 		) paths='./cmd/...' paths='./internal/...' $(\
 		) output:dir='config/rbac' # {directory}/role.yaml
+
+# https://www.gnu.org/software/make/manual/make.html#Multi_002dLine
+define newline
+
+
+endef

hack/check-manifests.awk

@@ -0,0 +1,26 @@
+# Copyright 2025 Crunchy Data Solutions, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+## TODO: Exit successfully only when there are no errors.
+#/^ERROR:/ { rc = 1 }
+#END { exit rc }
+
+# Shorten these frequent messages about validation rules.
+/The maximum allowable value is 10000000[.]/ {
+	sub(/ The maximum allowable value is 10000000./, "")
+	sub(/ allowed budget/, "&, 10M")
+}
+
+# These are informational, but "MustNot" sounds like something is wrong.
+/^info: "MustNotExceedCostBudget"/ {
+	sub(/"MustNotExceedCostBudget"/, "\"CostBudget\"")
+}
+
+# Color errors and warnings when attached to a terminal.
+ENVIRON["MAKE_TERMOUT"] != "" {
+	sub(/^ERROR:/, "\033[0;31m&\033[0m")
+	sub(/^Warning:/, "\033[1;33m&\033[0m")
+}
+
+{ print }