🐛 Fix an unclear validation error when configuring watchNamespace on an operator restricted to AllNamespaces mode.

internal/operator-controller/config/config.go

@@ -45,6 +45,9 @@ const (
 	// FormatSingleNamespaceInstallMode defines the format check to ensure that
 	// the watchNamespace must differ from install namespace
 	FormatSingleNamespaceInstallMode = "singleNamespaceInstallMode"
+	// FormatAllNamespacesOnlyInstallMode defines the format check to reject
+	// watchNamespace when only AllNamespaces mode is supported (registry+v1 specific)
+	FormatAllNamespacesOnlyInstallMode = "allNamespacesOnlyInstallMode"
 )
 
 // SchemaProvider lets each package format type describe what configuration it accepts.
@@ -192,6 +195,14 @@ func validateConfigWithSchema(configBytes []byte, schema map[string]any, install
  return nil
  },
 	})
+	compiler.RegisterFormat(&jsonschema.Format{
+ Name: FormatAllNamespacesOnlyInstallMode,
+ Validate: func(value interface{}) error {
+ // Always reject - this format is used when AllNamespaces is the only supported mode
+ // and watchNamespace configuration doesn't make sense
+ return fmt.Errorf("watchNamespace configuration is not supported when the content only supports AllNamespaces install mode")
+ },
+	})
 
 	if err := compiler.AddResource(configSchemaID, schema); err != nil {
  return fmt.Errorf("failed to load schema: %w", err)

internal/operator-controller/config/config_test.go

@@ -80,22 +80,10 @@ func Test_UnmarshalConfig(t *testing.T) {
  expectedErrMessage: `got object, want string`,
  },
  {
- name: "rejects with unknown field when install modes {AllNamespaces}",
+ name: "rejects with descriptive message when install modes {AllNamespaces}",
  supportedInstallModes: []v1alpha1.InstallModeType{v1alpha1.InstallModeTypeAllNamespaces},
  rawConfig: []byte(`{"watchNamespace": "some-namespace"}`),
- expectedErrMessage: `unknown field "watchNamespace"`,
- },
- {
- name: "rejects with unknown field when install modes {MultiNamespace}",
- supportedInstallModes: []v1alpha1.InstallModeType{v1alpha1.InstallModeTypeMultiNamespace},
- rawConfig: []byte(`{"watchNamespace": "some-namespace"}`),
- expectedErrMessage: `unknown field "watchNamespace"`,
- },
- {
- name: "reject with unknown field when install modes {AllNamespaces, MultiNamespace}",
- supportedInstallModes: []v1alpha1.InstallModeType{v1alpha1.InstallModeTypeAllNamespaces, v1alpha1.InstallModeTypeMultiNamespace},
- rawConfig: []byte(`{"watchNamespace": "some-namespace"}`),
- expectedErrMessage: `unknown field "watchNamespace"`,
+ expectedErrMessage: `watchNamespace configuration is not supported when the content only supports AllNamespaces install mode`,
  },
  {
  name: "reject with required field when install modes {OwnNamespace} and watchNamespace is null",

internal/operator-controller/rukpak/bundle/registryv1.go

@@ -34,7 +34,7 @@ func (rv1 *RegistryV1) GetConfigSchema() (map[string]any, error) {
 // buildBundleConfigSchema creates validation rules based on what the operator supports.
 //
 // Examples of how install modes affect validation:
-// - AllNamespaces only: user can't set watchNamespace (operator watches everything)
+// - AllNamespaces only: watchNamespace is explicitly rejected with helpful error
 // - OwnNamespace only: user must set watchNamespace to the install namespace
 // - SingleNamespace only: user must set watchNamespace to a different namespace
 // - AllNamespaces + OwnNamespace: user can optionally set watchNamespace
@@ -48,8 +48,12 @@ func buildBundleConfigSchema(installModes sets.Set[v1alpha1.InstallMode]) (map[s
 	properties := map[string]any{}
 	var required []any
 
-	// Add watchNamespace property if the bundle supports it
-	if isWatchNamespaceConfigurable(installModes) {
+	// Special case: if ONLY AllNamespaces is supported, explicitly reject watchNamespace
+	// with a helpful error message (instead of generic "unknown field")
+	if isAllNamespacesOnly(installModes) {
+ properties["watchNamespace"] = buildRejectedWatchNamespaceProperty()
+	} else if isWatchNamespaceConfigurable(installModes) {
+ // Add watchNamespace property if the bundle supports it
  watchNSProperty, isRequired := buildWatchNamespaceProperty(installModes)
  properties["watchNamespace"] = watchNSProperty
  if isRequired {
@@ -151,3 +155,27 @@ func isWatchNamespaceConfigRequired(installModes sets.Set[v1alpha1.InstallMode])
 	return isWatchNamespaceConfigurable(installModes) &&
  !installModes.Has(v1alpha1.InstallMode{Type: v1alpha1.InstallModeTypeAllNamespaces, Supported: true})
 }
+
+// isAllNamespacesOnly checks if only AllNamespaces install mode is supported.
+//
+// Returns true when:
+// - Only AllNamespaces is supported (no OwnNamespace, no SingleNamespace)
+//
+// Returns false when:
+// - OwnNamespace or SingleNamespace is also supported
+func isAllNamespacesOnly(installModes sets.Set[v1alpha1.InstallMode]) bool {
+	hasAllNamespaces := installModes.Has(v1alpha1.InstallMode{Type: v1alpha1.InstallModeTypeAllNamespaces, Supported: true})
+	hasConfigurable := isWatchNamespaceConfigurable(installModes)
+
+	return hasAllNamespaces && !hasConfigurable
+}
+
+// buildRejectedWatchNamespaceProperty creates a schema property that always rejects
+// watchNamespace with a descriptive error message for AllNamespaces-only operators.
+func buildRejectedWatchNamespaceProperty() map[string]any {
+	return map[string]any{
+ "type": "string",
+ "format": config.FormatAllNamespacesOnlyInstallMode,
+ "description": "This field is not supported for this operator's install mode configuration",
+	}
+}