CEL validation of format: byte CRD fields fails on standard base64 #633

I have a CRD with a format: byte field and a CEL transition rule that compares it (self.data == oldSelf.data). Updating the resource, even with identical data, fails:

Invalid byte formatted string H4sIAAAAAAAA/0TL...: illegal base64 data at input byte 12

The value is valid standard base64 (RFC 4648 section 4). The / at byte 12 is legal. Creation works fine because transition rules aren't evaluated without oldSelf.

The problem is in strfmt.Base64.UnmarshalText, which the CEL value converter calls when evaluating rules on format: byte fields. UnmarshalText decodes with base64.URLEncoding (expects - and _), but Go's encoding/json serializes []byte fields with base64.StdEncoding (produces + and /). Any value containing either character is rejected.

The strfmt.Base64 type is also internally inconsistent: UnmarshalText/MarshalText use URLEncoding, while UnmarshalJSON/MarshalJSON/String() use StdEncoding. This was already fixed upstream in go-openapi/strfmt#283 but the vendored copy in kube-openapi still carries the old behavior.

Related: go-openapi/strfmt#87