OpenAPI model names for the core and sdn groups are Go paths, so a $ref does not resolve and client-side validation fails #3806

Summary

The aggregated apiserver publishes an OpenAPI document whose model names are Go import paths rather than dotted Kubernetes model names, and one of the resulting $refs does not resolve. Any client that validates against that document fails, on any resource, not only on the one named in the error.

error validating data: SchemaError(github.com/cozystack/cozystack/pkg/apis/core/v1alpha1.Option.spec):
unknown model in reference: "github.com~1cozystack~1cozystack~1pkg~1apis~1core~1v1alpha1.OptionSpec"

~1 is an escaped slash. Kubernetes expects a dotted model name (com.github.cozystack.cozystack.pkg.apis.core.v1alpha1.OptionSpec); what is served is the Go path.

On current main there are 20 slash-bearing definition names in pkg/generated/openapi/zz_generated.openapi.go, covering the core and sdn groups. The apps group does not have them, because b916d74 already fixed it there.

Impact

kubectl apply --validate against a cluster running a cozystack-api built after 2026-07-21 fails on any resource. The first occurrence in CI was a plain kubectl --validate in a chainsaw script, not a Helm path, which is what shows the document is broken for every client rather than for one consumer.

This shipped in v1.6.0 and v1.6.1.

In e2e it currently manifests as the platform install failing on cozy-backup-controller/backupstrategy-controller and never completing, which takes tenant-root and everything behind cozystack-basics with it.

When it started

Window opens at 960d853 (2026-07-21). 190 failed-E2E logs from 2026-06-25 to 07-19 have zero hits; the first hit is 11 hours after that merge.

It was rare at first, 3 hits across 375 scanned failed-E2E jobs, and two of those were genuine install failures on charts predating the MongoDB driver, so the base could already fail this way on its own.

#3562 did not cause it, it made it deterministic. Since that merge, 7 of 7 PR runs that actually reached E2E hit it, across five unrelated PRs including two Renovate branches. The other three post-merge failures had E2E skipped rather than green. #3562 was itself red with this signature six times on its own branch between 2026-08-05 and 08-12 before merging.

The 2026-08-13 nightly is clean, but only because its head predates the merge by 8.5 hours, and no nightly has run since, so it carries no information about post-#3562 main.

Fix

Mirror b916d74 to core and sdn: +k8s:openapi-model-package=com.github.cozystack.cozystack.pkg.apis.{core,sdn}.v1alpha1 in each doc.go, a hand-written model_name.go declaring OpenAPIModelName() for all 20 types, then regenerate with the root make generate. The code-generator v0.35.0 pin already matches the runtime, so this is not the codegen-lagging-runtime class.

A counterfactual generation with those markers in place produces 0 slash-bearing names and 0 dangling refs.

Reverting #3562 is not worth it. It removes the deterministic trigger but leaves the defect that already broke installs twice without it, and leaves kubectl --validate broken on every cluster.

Missing guard

Nothing asserts that a definition name contains no /. That is why this reached two releases unnoticed, and it is the check worth adding alongside the fix, since the same omission on a future group would be equally invisible.