fix(api): enforce EtcdSnapshot spec immutability

[Immanuel Tikhonov (immanuwell)]

EtcdSnapshot is documented as immutable, but the CRD currently accepts spec edits

Repro:

1. Create an EtcdSnapshot and let its Job start
2. Change spec.clusterRef or spec.destination with kubectl edit
3. The update succeeds, while the existing Job keeps the old values

This adds a CEL transition rule for the whole spec.
Metadata and status updates still work, so normal reconciliation stays intact

Tested with make test

Summary by CodeRabbit

• New Features

  • EtcdSnapshot specifications are now immutable after creation.
  • Metadata and status updates remain allowed.
  • To change snapshot settings, create a new snapshot.

• Bug Fixes

  • Prevented accidental modifications to existing snapshot configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 50e60b24-c5ca-490d-a9e3-4191ce8512e0

📥 Commits

Reviewing files that changed from the base of the PR and between a371f0c and 693708d.

📒 Files selected for processing (3)

• api/v1alpha2/etcdsnapshot_types.go
• api/v1alpha2/snapshot_cel_test.go
• charts/etcd-operator/crd-bases/etcd-operator.cozystack.io_etcdsnapshots.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The change makes EtcdSnapshot.spec immutable after creation through CEL validation and the CRD schema. Envtest coverage verifies rejected spec changes and permitted metadata and status updates.

Changes

EtcdSnapshot immutability

Layer / File(s)	Summary
Immutable spec validation api/v1alpha2/etcdsnapshot_types.go, charts/etcd-operator/crd-bases/..._etcdsnapshots.yaml	The API type and CRD schema require the current EtcdSnapshot.spec to equal its previous value.
Immutability envtest coverage api/v1alpha2/snapshot_cel_test.go	Tests verify that cluster reference and S3 key changes fail, while label and status updates succeed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 69370

The PR makes EtcdSnapshot specs immutable while preserving metadata and status updates, preventing edits that could diverge from the running Job. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: androndo

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1 unsupported.)	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enforcing EtcdSnapshot spec immutability.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}