Improve S3 profiles validation in validate clusters command

[parikshithb]

Currently, the validate clusters command only checks:

• That atleast one S3 profiles exist
• That S3 secrets exist on each cluster

Add validation for:

Hub:

• S3 profile values are not empty

Managed clusters:

• S3 profile values on managed cluster configmap matches hub configmap
• S3 secrets match hub secrets

[parikshithb]

@nirs Need help with the report structure, not sure best way to show profile/secret value mismatches.
My thoughts, wdyt?:

report structs:

// S3StoreProfilesSummary is the summary of S3 store profiles in the ConfigMap
type S3StoreProfilesSummary struct {
    S3ProfileName string               `json:"s3ProfileName"`
    MatchesHub    ValidatedBool        `json:"matchesHub,omitempty"` // Profile matches hub (managed clusters only)
    S3SecretRef   ValidatedS3SecretRef `json:"s3SecretRef"`
}

// ValidatedS3SecretRef is a validated S3 secret reference.
type ValidatedS3SecretRef struct {
    Validated
    Value      corev1.SecretReference `json:"value"`
    MatchesHub ValidatedBool          `json:"matchesHub,omitempty"` // Secret matches hub (managed clusters only)
}

Report when there are no mismatches:

# Hub (no MatchesHub field)
s3StoreProfiles:
  state: ok ✅
  value:
  - s3ProfileName: minio-on-dr1
    s3SecretRef:
      state: ok ✅
      value:
        name: ramen-s3-secret-dr1
        namespace: ramen-system

# Managed Cluster (with MatchesHub fields)
s3StoreProfiles:
  state: ok ✅
  value:
  - s3ProfileName: minio-on-dr1
    matchesHub:
      state: ok ✅
      value: true
    s3SecretRef:
      state: ok ✅
      value:
        name: ramen-s3-secret-dr1
        namespace: ramen-system
      matchesHub:
        state: ok ✅
        value: true

Report when there is a mismatch:

# Hub : empty profile values(add errors to the description?)
s3StoreProfiles:
  state: problem ❌
  description: "profile \"minio-on-dr1\": s3Bucket is empty; profile \"minio-on-dr1\": s3Region is empty"
  value:
  - s3ProfileName: minio-on-dr1
    s3SecretRef:
      state: ok ✅
      value:
        name: ramen-s3-secret-dr1
        namespace: ramen-system

# Managed Cluster : profile/secret mismatch
s3StoreProfiles:
  state: problem ❌
  value:
  - s3ProfileName: minio-on-dr1
    matchesHub:
      state: problem ❌
      value: false
      description: "s3Bucket \"wrong\" does not match hub \"bucket\""
    s3SecretRef:
      state: ok ✅
      value:
        name: ramen-s3-secret-dr1
        namespace: ramen-system
      matchesHub:
        state: problem ❌
        value: false
        description: "AWS_ACCESS_KEY_ID does not match hub"

[nirs]

@nirs Need help with the report structure, not sure best way to show profile/secret value mismatches. My thoughts, wdyt?:

We need to add all the profile fields to the validated profile:

• endpoint
• bucket
• caCertificate
• region

On the hub, we need to validate all the fields, which means that all must be non-empty, expect the caCertificate that is optional and does not exist drenv.

On the manage cluster we need to validate with the hub profile - the profile must have the same values that we have on the bu.

Finally for the entire profile list, we need to validate that we have the same list of profiles on the managed cluster. If the hub has profiles "a", "b", the managed cluster must have the same profile names. if it has "a", "c", it is a problem.