CRD validation doesn't support validating maps

[pwittrock]

According the openapi spec maps are represented as a:

{
  "type": "object",
  "additionalProperties": {
    "type": "string"
  }
}

However when using a CRD with that validation it accepts requests that shouldn't validate:

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: crontabs.stable.example.com
spec:
  group: stable.example.com
  version: v1
  scope: Namespaced
  names:
    kind: CronTab
  validation:
   # openAPIV3Schema is the schema for validating custom objects.
    openAPIV3Schema:
      properties:
        labels:
          type: object
          properties:
            additionalProperties: 
              type: string

Successfully created this yaml (shouldn't have)

apiVersion: stable.example.com/v1
kind: CronTab
labels:
  foo:
  - bar
metadata:
  name: name
spec:

Note: I have also gotten this error when using the go-client library to create the CRD spec:

[spec.validation.openAPIV3Schema.properties[metadata].properties[annotations].additionalProperties: Forbidden: additionalProperties cannot be set to false, spec.validation.openAPIV3Schema.properties[metadata].properties[labels].additionalProperties: Forbidden: additionalProperties cannot be set to false]

I suspect this is because when unmarshalling the json, Allows is not set to true:

https://github.com/kubernetes/apiextensions-apiserver/blob/master/pkg/apis/apiextensions/v1beta1/marshal.go#L43

[nikhita]

@pwittrock This is already being tracked in kubernetes/kubernetes#59485.

[nikhita]

Closing in favor of kubernetes/kubernetes#59485.

/close