add crd validation also in code + minor fixes

manifests/operatorconfiguration.crd.yaml

@@ -43,7 +43,6 @@ spec:
                 type: string
             name:
               type: string
-                # Note: the cluster name specified here must begin with the team name.
             namespace:
               type: string
         configuration:
@@ -96,11 +95,7 @@ spec:
                 enable_pod_disruption_budget:
                   type: boolean
                 infrastructure_roles_secret_name:
-                  type: object
-                  additionalProperties:
-                    type: array
-                    items:
-                      type: string
+                  type: string
                 inherited_labels:
                   type: array
                   items:

manifests/postgresql-operator-default-configuration.yaml

@@ -27,11 +27,12 @@ configuration:
     #   keyb: valueb
     enable_pod_antiaffinity: false
     enable_pod_disruption_budget: true
-    # infrastructure_roles_secret_name: ""
+    # infrastructure_roles_secret_name: postgresql-operator
     # inherited_labels:
     # - application
     # - environment
-    # node_readiness_label: ""
+    # node_readiness_label:
+    # - status:ready
     oauth_token_secret_name: postgresql-operator
     pdb_name_format: "postgres-{cluster}-pdb"
     pod_antiaffinity_topology_key: "kubernetes.io/hostname"
@@ -44,7 +45,7 @@ configuration:
     # spilo_fsgroup: 103
     spilo_privileged: false
     # toleration: {}
-    # watched_namespace:""
+    # watched_namespace: ""
   postgres_pod_resources:
     default_cpu_limit: "3"
     default_cpu_request: 100m
@@ -91,7 +92,8 @@ configuration:
     enable_teams_api: false
     # pam_configuration: ""
     pam_role_name: zalandos
-    # postgres_superuser_teams: "postgres_superusers"
+    # postgres_superuser_teams:
+    #   - postgres_superusers
     protected_role_names:
       - admin
     team_admin_role: admin

manifests/postgresql.crd.yaml

@@ -267,17 +267,37 @@ spec:
               additionalProperties:
                 type: array
                 nullable: true
+                description: "Role flags specified here must not contradict each other"
                 items:
-                  enum: [
-                    bypassrls, nobypassrls,
-                    createdb, nocreatedb,
-                    createrole, nocreaterole,
-                    inherit, noinherit,
-                    login, nologin,
-                    replication, noreplication,
-                    superuser, nosuperuser,
-                  ]
-                  # Note: role flags specified here must not contradict each other.
+                  enum:
+                  - bypassrls
+                  - BYPASSRLS
+                  - nobypassrls
+                  - NOBYPASSRLS
+                  - createdb
+                  - CREATEDB
+                  - nocreatedb
+                  - NOCREATEDB
+                  - createrole
+                  - CREATEROLE
+                  - nocreaterole
+                  - NOCREATEROLE
+                  - inherit
+                  - INHERIT
+                  - noinherit
+                  - NOINHERIT
+                  - login
+                  - LOGIN
+                  - nologin
+                  - NOLOGIN
+                  - replication
+                  - REPLICATION
+                  - noreplication
+                  - NOREPLICATION
+                  - superuser
+                  - SUPERUSER
+                  - nosuperuser
+                  - NOSUPERUSER
             volume:
               type: object
               required: