feat(kubernetes): add explicit Docker workload recipe (#3648)

2026-09-14 23:42:16 +02:00
parent 8acb32c889
commit 4a0399de83
35 changed files with 2625 additions and 271 deletions
@@ -0,0 +1,101 @@
+package kubernetes
+
+import (
+	"errors"
+	"fmt"
+	pathpkg "path"
+	"reflect"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+func validateWorkspaceClaimAliases(volumes, desired []corev1.Volume) error {
+	var claim string
+	for _, volume := range desired {
+		if volume.Name == WorkspaceVolumeName && volume.PersistentVolumeClaim != nil {
+			claim = volume.PersistentVolumeClaim.ClaimName
+			break
+		}
+	}
+	if claim == "" {
+		return nil
+	}
+	for _, volume := range volumes {
+		if volume.Name != WorkspaceVolumeName && volume.PersistentVolumeClaim != nil &&
+			volume.PersistentVolumeClaim.ClaimName == claim {
+			return errors.New("workspace claim must only be referenced by the owned workspace volume")
+		}
+	}
+	return nil
+}
+
+// companionWithoutWorkspaceGrant validates and removes the one permitted grant
+// from a copy, leaving all other fields subject to the reserved-field checks.
+func companionWithoutWorkspaceGrant(container *corev1.Container) (*corev1.Container, *corev1.VolumeMount, error) {
+	copy := container.DeepCopy()
+	copy.VolumeMounts = nil
+	var grant *corev1.VolumeMount
+	for _, mount := range container.VolumeMounts {
+		if mount.Name == WorkspaceVolumeName {
+			allowed := corev1.VolumeMount{Name: WorkspaceVolumeName, MountPath: WorkspaceMountPath, ReadOnly: mount.ReadOnly}
+			if grant != nil || !reflect.DeepEqual(mount, allowed) {
+				return nil, nil, errors.New("workspace grant must be one direct RO/RW mount at /workspace")
+			}
+			grant = &allowed
+		} else {
+			copy.VolumeMounts = append(copy.VolumeMounts, mount)
+		}
+	}
+	if grant != nil {
+		for _, mount := range copy.VolumeMounts {
+			path := pathpkg.Clean(mount.MountPath)
+			if path == "/" || isPathAtOrBelow(WorkspaceMountPath, path) || isPathAtOrBelow(path, WorkspaceMountPath) {
+				return nil, nil, errors.New("workspace grant overlaps another mount")
+			}
+		}
+	}
+	return copy, grant, nil
+}
+
+func validateAdmittedWorkspaceGrants(admitted, desired *corev1.Pod, mainContainer string) error {
+	seen := make(map[string]bool)
+	for i := range admitted.Spec.Containers {
+		container := &admitted.Spec.Containers[i]
+		if seen[container.Name] {
+			return errors.New("admitted Pod has duplicate container identities")
+		}
+		seen[container.Name] = true
+		if container.Name == mainContainer {
+			continue
+		}
+		_, grant, err := companionWithoutWorkspaceGrant(container)
+		if err != nil {
+			return err
+		}
+		requested := admittedContainerByName(desired.Spec.Containers, container.Name)
+		var expected *corev1.VolumeMount
+		if requested != nil {
+			_, expected, err = companionWithoutWorkspaceGrant(requested)
+			if err != nil {
+				return err
+			}
+		}
+		if !reflect.DeepEqual(grant, expected) {
+			return fmt.Errorf("admitted Pod changed workspace grant for %q", container.Name)
+		}
+	}
+	for i := range desired.Spec.Containers {
+		container := &desired.Spec.Containers[i]
+		if container.Name == mainContainer {
+			continue
+		}
+		_, grant, err := companionWithoutWorkspaceGrant(container)
+		if err != nil {
+			return err
+		}
+		if grant != nil && !seen[container.Name] {
+			return errors.New("admitted Pod removed a workspace recipient")
+		}
+	}
+	return nil
+}