[confcom] Derive image platform and add --platform validation

Author: MahatiC

src/confcom/azext_confcom/security_policy.py

@@ -16,7 +16,7 @@
 from azext_confcom.container import ContainerImage, UserContainerImage
 from azext_confcom.errors import eprint
 from azext_confcom.fragment_util import sanitize_fragment_fields
-from azext_confcom.oras_proxy import create_list_of_standalone_imports
+from azext_confcom.oras_proxy import create_list_of_standalone_imports, get_image_platforms
 from azext_confcom.rootfs_proxy import SecurityPolicyProxy
 from azext_confcom.template_util import (case_insensitive_dict_get,
                                          compare_env_vars,
@@ -41,7 +41,8 @@
                                          process_fragment_imports,
                                          process_mounts,
                                          process_mounts_from_config,
-                                         readable_diff)
+                                         readable_diff,
+                                         find_value_in_params_and_vars)
 from azext_confcom.lib.images import get_image_platform  # pylint: disable=unused-import
 from azext_confcom.lib.defaults import get_debug_mode_exec_procs
 from knack.log import get_logger
@@ -669,6 +670,36 @@ def set_images(self, images: List[ContainerImage]) -> None:
         self._images = images
 
 
+def validate_image_platform(image_name: str, platform: str) -> None:
+    """Validate that a single-platform image matches the specified platform.
+
+    Uses the registry manifest to detect supported platforms. If the image
+    supports only one platform and it differs from the requested platform,
+    an error is raised. Multi-platform images and detection failures are
+    allowed to pass through.
+    """
+    try:
+        supported = get_image_platforms(image_name)
+    except Exception:  # pylint: disable=broad-except
+        # If registry detection fails, skip validation gracefully
+        return
+
+    if not supported:
+        return
+
+    if len(supported) == 1 and supported[0] != platform:
+        eprint(
+            f'Image "{image_name}" only supports platform "{supported[0]}", '
+            f'which does not match the specified platform "{platform}".'
+        )
+
+    if len(supported) > 1 and platform not in supported:
+        eprint(
+            f'Image "{image_name}" supports platforms {supported}, '
+            f'which does not include the specified platform "{platform}".'
+        )
+
+
 # pylint: disable=R0914,
 def load_policy_from_arm_template_str(
     template_data: str,
@@ -830,6 +861,10 @@ def load_policy_from_arm_template_str(
                     f'Field ["{config.ACI_FIELD_TEMPLATE_IMAGE}"] is empty or cannot be found'
                 )
 
+            # Resolve ARM parameters/variables to get the real image name for validation
+            resolved_image = find_value_in_params_and_vars(all_params, all_vars, image_name)
+            validate_image_platform(resolved_image, platform)
+
             exec_processes = []
             extract_probe(exec_processes, image_properties, config.ACI_FIELD_CONTAINERS_READINESS_PROBE)
             extract_probe(exec_processes, image_properties, config.ACI_FIELD_CONTAINERS_LIVENESS_PROBE)
@@ -920,6 +955,8 @@ def load_policy_from_image_name(
 
     containers = []
     for image_name in image_names:
+        validate_image_platform(image_name, platform)
+
         container = {}
         # assign just the fields that are expected
         # the values will come when calling
@@ -1037,6 +1074,8 @@ def load_policy_from_json(
                 f'Field ["{config.ACI_FIELD_TEMPLATE_IMAGE}"] is empty or cannot be found'
             )
 
+        validate_image_platform(image_name, platform)
+
         container_name = case_insensitive_dict_get(
             container, config.ACI_FIELD_CONTAINERS_NAME
         ) or image_name
@@ -1250,6 +1289,8 @@ def load_policy_from_virtual_node_yaml_str(
             if not image:
                 eprint("Container does not have an image field")
 
+            validate_image_platform(image, platform)
+
             # env vars
             envs = process_env_vars_from_yaml(
                 container,