[fix] inject registry as plain values to fix CEL validation

pkg/module_manager/models/modules/values_storage.go

@@ -52,6 +52,26 @@ type Registry struct {
 	CA        string `json:"ca,omitempty" yaml:"ca,omitempty"`
 }
 
+// toValues renders the registry as plain JSON types, keeping the struct's own JSON shape.
+// Values are walked natively by CEL (structpb) and OpenAPI validation, both fail on a Go struct.
+func (r *Registry) toValues() map[string]any {
+	if r == nil {
+		return nil
+	}
+
+	values := map[string]any{
+		"base":      r.Base,
+		"dockercfg": r.DockerCfg,
+		"scheme":    r.Scheme,
+	}
+
+	if r.CA != "" {
+		values["ca"] = r.CA
+	}
+
+	return values
+}
+
 // NewValuesStorage build a new storage for module values
 //
 //	staticValues - values from /modules/<module-name>/values.yaml, which couldn't be reloaded during the runtime
@@ -212,7 +232,7 @@ func (vs *ValuesStorage) InjectRegistryValue(registry *Registry) {
 		vs.staticValues = utils.Values{}
 	}
 
-	vs.staticValues["registry"] = registry
+	vs.staticValues["registry"] = registry.toValues()
 
 	_ = vs.calculateResultValues()
 }

pkg/module_manager/models/modules/values_storage_test.go

@@ -203,3 +203,77 @@ modulesImages:
     tags: {}
 `, v.AsString("yaml"))
 }
+
+func TestInjectRegistryValue(t *testing.T) {
+	// the rule sits at the root of the config schema: ExtendTransformer copies root
+	// extensions into the values schema, so it is evaluated against module values too
+	cfg := `
+type: object
+default: {}
+additionalProperties: false
+properties:
+  xxx:
+    type: string
+x-deckhouse-validations:
+  - expression: 'self.registry.base != ""'
+    message: registry.base must be set
+`
+
+	vcfg := `
+x-extend:
+  schema: config-values.yaml
+type: object
+default: {}
+properties:
+  internal:
+    type: object
+    default: {}
+`
+
+	tests := []struct {
+		name string
+		give *Registry
+		want string
+	}{
+		{
+			name: "empty CA is omitted",
+			give: &Registry{Base: "registry.example.com/d8", DockerCfg: "e30=", Scheme: "HTTPS"},
+			want: `
+xxx: yyy
+internal: {}
+registry:
+    base: registry.example.com/d8
+    dockercfg: e30=
+    scheme: HTTPS
+`,
+		},
+		{
+			name: "CA is kept",
+			give: &Registry{Base: "registry.example.com/d8", DockerCfg: "e30=", Scheme: "HTTPS", CA: "ca-content"},
+			want: `
+xxx: yyy
+internal: {}
+registry:
+    base: registry.example.com/d8
+    ca: ca-content
+    dockercfg: e30=
+    scheme: HTTPS
+`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			valuesStorage, err := NewValuesStorage("test-module", utils.Values{"xxx": "yyy"}, []byte(cfg), []byte(vcfg))
+			require.NoError(t, err)
+
+			valuesStorage.InjectRegistryValue(tt.give)
+
+			values := valuesStorage.GetValues(false)
+			// values must hold plain JSON types: CEL converts them with structpb and
+			// fails on a Go struct, both as the current and as the previous value
+			require.NoError(t, valuesStorage.validateValues(values))
+			assert.YAMLEq(t, tt.want, values.AsString("yaml"))
+		})
+	}
+}