Enforcing immutability of Kubernetes custom resource spec fields
This validation is possible by using the ValidatingAdmissionWebhook with future support coming via CRD's OpenAPI validation.
AFAIK this is not yet available to CRDs. Our approach is generally to use the object name as the default name of the object being controlled (vhost name in this case) so it just naturally works out okay.