fix: remove status fields from the list of required fields before type-checking

Remove status from required fields before type-checking. This allows CEL expressions in dependent resources to reference instance status (e.g., `${schema.status.endpoint}`) without validation errors when the instance status hasn't been populated yet.

Signed-off-by: Bruno Schaatsbergen <[email protected]>

Author: bschaatsbergen

pkg/graph/builder.go

@@ -829,6 +829,24 @@ func validateReadyWhenExpressions(env *cel.Env, resource *Resource) error {
 	return nil
 }
 
+// unrequireStatus modifies the schema to ensure "status" is not in the required fields list.
+// This prevents CEL type-checking from treating status as a required field, which would incorrectly
+// fail validation when status is legitimately absent (e.g., resources that haven't reconciled yet).
+func unrequireStatus(s *spec.Schema) {
+	if s == nil || len(s.Required) == 0 {
+		return
+	}
+
+	// Remove "status" from required fields if present
+	required := make([]string, 0, len(s.Required))
+	for _, field := range s.Required {
+		if field != "status" {
+			required = append(required, field)
+		}
+	}
+	s.Required = required
+}
+
 // getInstanceSchema returns a schema from the CRD including spec, status, and metadata fields.
 // This schema is used for CEL expression validation, allowing references to instance fields like
 // ${schema.spec.field}, ${schema.status.field}, and ${schema.metadata.name}.
@@ -855,5 +873,11 @@ func getInstanceSchema(crd *extv1.CustomResourceDefinition) (*spec.Schema, error
 		specSchema.Properties = make(map[string]spec.Schema)
 	}
 	specSchema.Properties["metadata"] = schema.ObjectMetaSchema
+
+	// Unrequire status before type-checking. This allows CEL expressions
+	// in dependent resources to reference instance status (e.g., ${schema.status.endpoint})
+	// without validation errors when the instance status hasn't been populated yet.
+	unrequireStatus(specSchema)
+
 	return specSchema, nil
 }

pkg/graph/builder_test.go

@@ -1767,7 +1767,7 @@ func TestGraphBuilder_CELTypeChecking(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name: "valid schema.status field reference",
+			name: "resource references instance status field (string)",
 			resourceGraphDefinitionOpts: []generator.ResourceGraphDefinitionOption{
 				generator.WithSchema(
 					"Application", "v1alpha1",
@@ -1802,6 +1802,127 @@ func TestGraphBuilder_CELTypeChecking(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name: "resource references instance status field (nested object)",
+			resourceGraphDefinitionOpts: []generator.ResourceGraphDefinitionOption{
+				generator.WithSchema(
+					"NetworkApp", "v1alpha1",
+					map[string]interface{}{
+						"vpcName": "string",
+					},
+					map[string]interface{}{
+						"vpcState": "${vpc.status.state}",
+					},
+				),
+				generator.WithResource("vpc", map[string]interface{}{
+					"apiVersion": "ec2.services.k8s.aws/v1alpha1",
+					"kind":       "VPC",
+					"metadata": map[string]interface{}{
+						"name": "${schema.spec.vpcName}",
+					},
+					"spec": map[string]interface{}{
+						"cidrBlocks": []interface{}{"10.0.0.0/16"},
+					},
+				}, nil, nil),
+				generator.WithResource("securitygroup", map[string]interface{}{
+					"apiVersion": "ec2.services.k8s.aws/v1alpha1",
+					"kind":       "SecurityGroup",
+					"metadata": map[string]interface{}{
+						"name": "${schema.spec.vpcName}-sg",
+					},
+					"spec": map[string]interface{}{
+						"description": "VPC state is: ${schema.status.vpcState}",
+					},
+				}, nil, nil),
+			},
+			wantErr: false,
+		},
+		{
+			name: "multiple resources reference same instance status field",
+			resourceGraphDefinitionOpts: []generator.ResourceGraphDefinitionOption{
+				generator.WithSchema(
+					"Application", "v1alpha1",
+					map[string]interface{}{
+						"region": "string",
+					},
+					map[string]interface{}{
+						"primaryVPCID": "${vpc.status.vpcID}",
+					},
+				),
+				generator.WithResource("vpc", map[string]interface{}{
+					"apiVersion": "ec2.services.k8s.aws/v1alpha1",
+					"kind":       "VPC",
+					"metadata": map[string]interface{}{
+						"name": "primary-vpc",
+					},
+					"spec": map[string]interface{}{
+						"cidrBlocks": []interface{}{"10.0.0.0/16"},
+					},
+				}, nil, nil),
+				generator.WithResource("subnet1", map[string]interface{}{
+					"apiVersion": "ec2.services.k8s.aws/v1alpha1",
+					"kind":       "Subnet",
+					"metadata": map[string]interface{}{
+						"name": "subnet-1",
+					},
+					"spec": map[string]interface{}{
+						"cidrBlock": "10.0.1.0/24",
+						"vpcID":     "${schema.status.primaryVPCID}",
+					},
+				}, nil, nil),
+				generator.WithResource("subnet2", map[string]interface{}{
+					"apiVersion": "ec2.services.k8s.aws/v1alpha1",
+					"kind":       "Subnet",
+					"metadata": map[string]interface{}{
+						"name": "subnet-2",
+					},
+					"spec": map[string]interface{}{
+						"cidrBlock": "10.0.2.0/24",
+						"vpcID":     "${schema.status.primaryVPCID}",
+					},
+				}, nil, nil),
+			},
+			wantErr: false,
+		},
+		{
+			name: "resource references instance status field (boolean computed)",
+			resourceGraphDefinitionOpts: []generator.ResourceGraphDefinitionOption{
+				generator.WithSchema(
+					"Application", "v1alpha1",
+					map[string]interface{}{
+						"region": "string",
+					},
+					map[string]interface{}{
+						"vpcReady": "${vpc.status.state == 'available'}",
+					},
+				),
+				generator.WithResource("vpc", map[string]interface{}{
+					"apiVersion": "ec2.services.k8s.aws/v1alpha1",
+					"kind":       "VPC",
+					"metadata": map[string]interface{}{
+						"name": "app-vpc",
+					},
+					"spec": map[string]interface{}{
+						"cidrBlocks": []interface{}{"10.0.0.0/16"},
+					},
+				}, nil, nil),
+				generator.WithResource("subnet", map[string]interface{}{
+					"apiVersion": "ec2.services.k8s.aws/v1alpha1",
+					"kind":       "Subnet",
+					"metadata": map[string]interface{}{
+						"name": "conditional-subnet",
+						"labels": map[string]interface{}{
+							"vpc-ready": "${schema.status.vpcReady ? 'true' : 'false'}",
+						},
+					},
+					"spec": map[string]interface{}{
+						"cidrBlock": "10.0.1.0/24",
+						"vpcID":     "${vpc.status.vpcID}",
+					},
+				}, nil, nil),
+			},
+			wantErr: false,
+		},
 	}
 
 	for _, tt := range tests {