How can I enforce uniqueness in a Kubernetes CRD slice without using a webhook?

Below is one approach using a CEL validation rule in your CRD’s schema to enforce uniqueness without resorting to a webhook. In Kubernetes CRDs the OpenAPI “uniqueItems: true” flag isn’t allowed because it may result in quadratic-time validation. Instead, you can remove that marker and add a CEL-based validation under the (non‑generated) openAPIV3Schema section.

For example, change your CRD validation to something like:

YAMLCopied
spec:
  validation:
    openAPIV3Schema:
      type: object
      properties:
        myItems:
          type: array
          items:
            type: string
          x-kubernetes-validations:
          - rule: "self.all(i, self.filter(j, j == i).size() == 1)"

This CEL rule works as follows:

• For each element (referred to as “i”) in the array it uses the filter function to collect all elements equal to i.
• It then checks that the size of that filtered list is exactly 1 (i.e. that element occurs only once).

By embedding this validation into your CRD schema (and removing the “UniqueItems” marker), you can ensure that the slice contains no duplicates without writing an external webhook.

Make sure your cluster supports CEL validation (available in recent Kubernetes versions) before using this technique.