Add validation for EventPolicy sub suffix matching

pkg/apis/eventing/v1alpha1/eventpolicy_validation.go

@@ -18,6 +18,7 @@ package v1alpha1
 
 import (
 	"context"
+	"strings"
 
 	"knative.dev/pkg/apis"
 )
@@ -36,6 +37,7 @@ func (ets *EventPolicySpec) Validate(ctx context.Context) *apis.FieldError {
 			err = err.Also(apis.ErrMultipleOneOf("ref", "sub").ViaFieldIndex("from", i))
 		}
 		err = err.Also(f.Ref.Validate().ViaField("ref").ViaFieldIndex("from", i))
+		err = err.Also(validateSub(f.Sub).ViaField("sub").ViaFieldIndex("from", i))
 	}
 
 	for i, t := range ets.To {
@@ -53,6 +55,20 @@ func (ets *EventPolicySpec) Validate(ctx context.Context) *apis.FieldError {
 	return err
 }
 
+func validateSub(sub *string) *apis.FieldError {
+	if sub == nil || len(*sub) <= 1 {
+		return nil
+	}
+
+	lastInvalidIdx := len(*sub) - 2
+	firstInvalidIdx := 0
+	if idx := strings.IndexRune(*sub, '*'); idx >= firstInvalidIdx && idx <= lastInvalidIdx {
+		return apis.ErrInvalidValue(*sub, "", "'*' is only allowed as suffix")
+	}
+
+	return nil
+}
+
 func (r *EventPolicyFromReference) Validate() *apis.FieldError {
 	if r == nil {
 		return nil

pkg/apis/eventing/v1alpha1/eventpolicy_validation_test.go

@@ -196,6 +196,58 @@ func TestEventPolicySpecValidation(t *testing.T) {
 				return apis.ErrMissingField("apiVersion").ViaField("ref").ViaFieldIndex("to", 0).ViaField("spec")
 			}(),
 		},
+		{
+			name: "invalid, from.sub '*' set as infix",
+			ep: &EventPolicy{
+				Spec: EventPolicySpec{
+					From: []EventPolicySpecFrom{{
+						Sub: ptr.String("a*c"),
+					}},
+				},
+			},
+			want: func() *apis.FieldError {
+				return apis.ErrInvalidValue("a*c", "sub", "'*' is only allowed as suffix").ViaFieldIndex("from", 0).ViaField("spec")
+			}(),
+		},
+		{
+			name: "invalid, from.sub '*' set as prefix",
+			ep: &EventPolicy{
+				Spec: EventPolicySpec{
+					From: []EventPolicySpecFrom{{
+						Sub: ptr.String("*a"),
+					}},
+				},
+			},
+			want: func() *apis.FieldError {
+				return apis.ErrInvalidValue("*a", "sub", "'*' is only allowed as suffix").ViaFieldIndex("from", 0).ViaField("spec")
+			}(),
+		},
+		{
+			name: "valid, from.sub '*' set as suffix",
+			ep: &EventPolicy{
+				Spec: EventPolicySpec{
+					From: []EventPolicySpecFrom{{
+						Sub: ptr.String("a*"),
+					}},
+				},
+			},
+			want: func() *apis.FieldError {
+				return nil
+			}(),
+		},
+		{
+			name: "valid, from.sub exactly '*'",
+			ep: &EventPolicy{
+				Spec: EventPolicySpec{
+					From: []EventPolicySpecFrom{{
+						Sub: ptr.String("*"),
+					}},
+				},
+			},
+			want: func() *apis.FieldError {
+				return nil
+			}(),
+		},
 	}
 
 	for _, test := range tests {