fix: Follow up PR6318 (#6782)

Without this, we are not applying in onepassword the same patterns as we
request other providers.

Signed-off-by: Jean-Philippe Evrard <jean-philippe.evrard+rochepub@external.roche.com>

apis/externalsecrets/v1/secretstore_onepassword_sdk_types.go

@@ -56,6 +56,7 @@ type CacheConfig struct {
 
 // OnePasswordSDKProvider configures a store to sync secrets using the 1Password sdk.
 // Exactly one of Vault or Environment must be set.
+// +kubebuilder:validation:AtMostOneOf=vault;environment
 type OnePasswordSDKProvider struct {
 	// Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically.
 	// Mutually exclusive with Environment.

config/crds/bases/external-secrets.io_clustersecretstores.yaml

@@ -4602,6 +4602,11 @@ spec:
                     required:
                     - auth
                     type: object
+                    x-kubernetes-validations:
+                    - message: at most one of the fields in [vault environment] may
+                        be set
+                      rule: '[has(self.vault),has(self.environment)].filter(x,x==true).size()
+                        <= 1'
                   openBao:
                     description: OpenBao configures this store to sync secrets using
                       the OpenBao provider.

config/crds/bases/external-secrets.io_secretstores.yaml

@@ -4602,6 +4602,11 @@ spec:
                     required:
                     - auth
                     type: object
+                    x-kubernetes-validations:
+                    - message: at most one of the fields in [vault environment] may
+                        be set
+                      rule: '[has(self.vault),has(self.environment)].filter(x,x==true).size()
+                        <= 1'
                   openBao:
                     description: OpenBao configures this store to sync secrets using
                       the OpenBao provider.

deploy/crds/bundle.yaml

@@ -6620,6 +6620,9 @@ spec:
                       required:
                         - auth
                       type: object
+                      x-kubernetes-validations:
+                        - message: at most one of the fields in [vault environment] may be set
+                          rule: '[has(self.vault),has(self.environment)].filter(x,x==true).size() <= 1'
                     openBao:
                       description: OpenBao configures this store to sync secrets using the OpenBao provider.
                       properties:
@@ -19829,6 +19832,9 @@ spec:
                       required:
                         - auth
                       type: object
+                      x-kubernetes-validations:
+                        - message: at most one of the fields in [vault environment] may be set
+                          rule: '[has(self.vault),has(self.environment)].filter(x,x==true).size() <= 1'
                     openBao:
                       description: OpenBao configures this store to sync secrets using the OpenBao provider.
                       properties: