Adding webhook validation for new shipwright build logic

As part of KMM transitioning to
Shipwright, KMM's webhook
should allow only the following
scenarios:
1. DockerfileOCIArtifact is
defined and not
DockerfileConfigMap.
2. DockerfileConfigMap is defined and not DockerfileOCIArtifact.

Author: TomerNewman

go.mod

@@ -19,6 +19,7 @@ require (
 	github.com/spf13/cobra v1.9.1
 	go.uber.org/mock v0.5.1
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
+	golang.org/x/net v0.38.0
 	golang.org/x/text v0.24.0
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.32.3
@@ -90,7 +91,6 @@ require (
 	go.opentelemetry.io/otel/trace v1.33.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
 	golang.org/x/oauth2 v0.25.0 // indirect
 	golang.org/x/sync v0.13.0 // indirect
 	golang.org/x/sys v0.32.0 // indirect

internal/webhook/module.go

@@ -173,6 +173,30 @@ func validateModuleLoaderContainerSpec(container kmmv1beta1.ModuleLoaderContaine
 			(km.InTreeModuleToRemove != "" && container.InTreeModulesToRemove != nil) { //nolint:staticcheck
 			return fmt.Errorf("only one type if field (InTreeModuleToRemove or InTreeModulesToRemove) can be defined in KenrelMapping or Container")
 		}
+
+		if err := validateModuleLoaderContainerBuildSpec(km.Build); err != nil {
+			return fmt.Errorf("failed to validate kernelMappings[%d].build: %v", idx, err)
+		}
+	}
+
+	return validateModuleLoaderContainerBuildSpec(container.Build)
+}
+
+func validateModuleLoaderContainerBuildSpec(build *kmmv1beta1.Build) error {
+	if build == nil {
+		return nil
+	}
+
+	if build.DockerfileOCIArtifact != "" && build.DockerfileConfigMap != nil {
+		return fmt.Errorf("only one of the Dockerfile fields: DockerfileOCIArtifact or DockerfileConfigMap can be defined")
+	}
+
+	if build.DockerfileOCIArtifact == "" && build.DockerfileConfigMap == nil {
+		return fmt.Errorf("one of the Dockerfile fields: DockerfileOCIArtifact or DockerfileConfigMap must be defined")
+	}
+
+	if build.DockerfileOCIArtifact != "" {
+		return validateImageFormat(build.DockerfileOCIArtifact)
 	}
 
 	return nil

internal/webhook/module_test.go

@@ -18,9 +18,10 @@ package webhook
 
 import (
 	"context"
-	v1 "k8s.io/api/core/v1"
 	"strings"
 
+	v1 "k8s.io/api/core/v1"
+
 	kmmv1beta1 "github.com/kubernetes-sigs/kernel-module-management/api/v1beta1"
 	"github.com/kubernetes-sigs/kernel-module-management/internal/utils"
 	. "github.com/onsi/ginkgo/v2"
@@ -232,6 +233,25 @@ var _ = Describe("validateModuleLoaderContainerSpec", func() {
 		)
 	})
 
+	It("should fail when a kernel-mapping has invalid Build specification", func() {
+		containerSpec := kmmv1beta1.ModuleLoaderContainerSpec{
+			KernelMappings: []kmmv1beta1.KernelMapping{
+				{
+					Regexp:         "^valid-regexp$",
+					ContainerImage: "image-url",
+					Build: &kmmv1beta1.Build{
+						DockerfileOCIArtifact: "registry.example.com/dockerfile:latest",
+						DockerfileConfigMap:   &v1.LocalObjectReference{Name: "dockerfile-configmap"},
+					},
+				},
+			},
+		}
+
+		Expect(
+			validateModuleLoaderContainerSpec(containerSpec),
+		).To(HaveOccurred())
+	})
+
 	DescribeTable("should fail when InTreeModulesToRemove and InTreeModuleToRemove both defined",
 		func(inTreeModulesInContainer, inTreeModuleInContainer, inTreeModulesInKM, inTreeModuleInKM bool) {
 			containerSpec := kmmv1beta1.ModuleLoaderContainerSpec{}
@@ -262,6 +282,80 @@ var _ = Describe("validateModuleLoaderContainerSpec", func() {
 
 })
 
+var _ = Describe("validateModuleLoaderContainerBuildSpec", func() {
+	It("should return nil when build is nil", func() {
+		Expect(validateModuleLoaderContainerBuildSpec(nil)).NotTo(HaveOccurred())
+	})
+
+	It("should pass when only DockerfileOCIArtifact is set with valid image format", func() {
+		build := &kmmv1beta1.Build{
+			DockerfileOCIArtifact: "registry.example.com/dockerfile:latest",
+		}
+		Expect(validateModuleLoaderContainerBuildSpec(build)).NotTo(HaveOccurred())
+	})
+
+	It("should pass when only DockerfileConfigMap is set", func() {
+		build := &kmmv1beta1.Build{
+			DockerfileConfigMap: &v1.LocalObjectReference{
+				Name: "dockerfile-configmap",
+			},
+		}
+		Expect(validateModuleLoaderContainerBuildSpec(build)).NotTo(HaveOccurred())
+	})
+
+	It("should fail when both DockerfileOCIArtifact and DockerfileConfigMap are set", func() {
+		build := &kmmv1beta1.Build{
+			DockerfileOCIArtifact: "registry.example.com/dockerfile:latest",
+			DockerfileConfigMap: &v1.LocalObjectReference{
+				Name: "dockerfile-configmap",
+			},
+		}
+		Expect(validateModuleLoaderContainerBuildSpec(build)).To(
+			MatchError(ContainSubstring("only one of the Dockerfile fields: DockerfileOCIArtifact or DockerfileConfigMap can be defined")),
+		)
+	})
+
+	It("should fail when neither DockerfileOCIArtifact nor DockerfileConfigMap is set", func() {
+		build := &kmmv1beta1.Build{}
+		Expect(validateModuleLoaderContainerBuildSpec(build)).To(
+			MatchError(ContainSubstring("one of the Dockerfile fields: DockerfileOCIArtifact or DockerfileConfigMap must be defined")),
+		)
+	})
+
+	It("should fail when DockerfileOCIArtifact has invalid image format", func() {
+		build := &kmmv1beta1.Build{
+			DockerfileOCIArtifact: "invalid-image-format",
+		}
+		Expect(validateModuleLoaderContainerBuildSpec(build)).To(
+			MatchError(ContainSubstring("container image must explicitely set a tag or digest")),
+		)
+	})
+
+	It("should pass when DockerfileOCIArtifact has valid image format with tag", func() {
+		build := &kmmv1beta1.Build{
+			DockerfileOCIArtifact: "registry.example.com/dockerfile:v1.0.0",
+		}
+		Expect(validateModuleLoaderContainerBuildSpec(build)).NotTo(HaveOccurred())
+	})
+
+	It("should pass when DockerfileOCIArtifact has valid image format with digest", func() {
+		build := &kmmv1beta1.Build{
+			DockerfileOCIArtifact: "registry.example.com/dockerfile@sha256:1234567890abcdef",
+		}
+		Expect(validateModuleLoaderContainerBuildSpec(build)).NotTo(HaveOccurred())
+	})
+
+	It("should fail when DockerfileOCIArtifact is empty string and DockerfileConfigMap is nil", func() {
+		build := &kmmv1beta1.Build{
+			DockerfileOCIArtifact: "",
+			DockerfileConfigMap:   nil,
+		}
+		Expect(validateModuleLoaderContainerBuildSpec(build)).To(
+			MatchError(ContainSubstring("one of the Dockerfile fields: DockerfileOCIArtifact or DockerfileConfigMap must be defined")),
+		)
+	})
+})
+
 var _ = Describe("validateModprobe", func() {
 	It("should fail when moduleName and rawArgs are missing", func() {
 		Expect(