Add CEL validation to prevent stale timestamp updates

- Add XValidation rule on PacemakerClusterStatus to reject updates where lastUpdated < oldSelf.lastUpdated
- Prevents race conditions when multiple collector jobs run concurrently (Replace or Allow concurrency policy)
- Server-side enforcement ensures stale updates are rejected by API server

Author: jaypoulz

etcd/v1alpha1/types_pacemakercluster.go

@@ -189,6 +189,7 @@ type PacemakerClusterSpec struct {
 }
 
 // PacemakerClusterStatus contains the actual pacemaker cluster status information
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.lastUpdated) || !has(self.lastUpdated) || self.lastUpdated >= oldSelf.lastUpdated",message="lastUpdated cannot be set to an earlier timestamp than the current value"
 type PacemakerClusterStatus struct {
 	// lastUpdated is the timestamp when this status was last updated
 	// When present, it must be a valid timestamp in RFC3339 format.

etcd/v1alpha1/zz_generated.crd-manifests/0000_25_etcd_01_pacemakerclusters.crd.yaml

@@ -408,6 +408,11 @@ spec:
                     type: integer
                 type: object
             type: object
+            x-kubernetes-validations:
+            - message: lastUpdated cannot be set to an earlier timestamp than the
+                current value
+              rule: '!has(oldSelf.lastUpdated) || !has(self.lastUpdated) || self.lastUpdated
+                >= oldSelf.lastUpdated'
         type: object
     served: true
     storage: true

etcd/v1alpha1/zz_generated.featuregated-crd-manifests/pacemakerclusters.etcd.openshift.io/AAA_ungated.yaml

@@ -409,6 +409,11 @@ spec:
                     type: integer
                 type: object
             type: object
+            x-kubernetes-validations:
+            - message: lastUpdated cannot be set to an earlier timestamp than the
+                current value
+              rule: '!has(oldSelf.lastUpdated) || !has(self.lastUpdated) || self.lastUpdated
+                >= oldSelf.lastUpdated'
         type: object
     served: true
     storage: true