fix(webhook): preserve required affinity branch semantics (#5757)

* test(requirenodewithfuse): add coverage for Mutate node-selector injection branch

Signed-off-by: Harsh <harshmastic@gmail.com>

* test(requirenodewithfuse): prove multi-term affinity injection appends only into term[0]

Signed-off-by: Harsh <harshmastic@gmail.com>

* test(requirenodewithfuse): strengthen multi-term affinity assertions

Signed-off-by: Harsh <harshmastic@gmail.com>

* fix(webhook): preserve required affinity branch semantics

Signed-off-by: Harsh <harshmastic@gmail.com>

* fix webhook empty affinity injection

Signed-off-by: Harsh <harshmastic@gmail.com>

* test avoid new testify assertions

Signed-off-by: Harsh <harshmastic@gmail.com>

* fix webhook empty required affinity injection

Signed-off-by: Harsh <harshmastic@gmail.com>

* fix webhook empty injected affinity terms

Signed-off-by: Harsh <harshmastic@gmail.com>

* test clean up require node with fuse assertions

Signed-off-by: Harsh <harshmastic@gmail.com>

---------

Signed-off-by: Harsh <harshmastic@gmail.com>

Author: hxrshxz

pkg/utils/webhook.go

@@ -62,10 +62,56 @@ func InjectNodeSelectorTerms(requiredSchedulingTerms []corev1.NodeSelectorTerm,
 	if len(pod.Spec.Affinity.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms) == 0 {
 		pod.Spec.Affinity.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms = requiredSchedulingTerms
 	} else {
+		hasRequiredConstraints := false
 		for i := 0; i < len(requiredSchedulingTerms); i++ {
-			pod.Spec.Affinity.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms[0].MatchExpressions =
-				append(pod.Spec.Affinity.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms[0].MatchExpressions, requiredSchedulingTerms[i].MatchExpressions...)
+			if len(requiredSchedulingTerms[i].MatchExpressions) != 0 || len(requiredSchedulingTerms[i].MatchFields) != 0 {
+				hasRequiredConstraints = true
+				break
+			}
+		}
+		if !hasRequiredConstraints {
+			return
+		}
+
+		existingTerms := pod.Spec.Affinity.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms
+		combinedTerms := make([]corev1.NodeSelectorTerm, 0, len(existingTerms)*len(requiredSchedulingTerms))
+		hasExistingConstraints := false
+		for i := 0; i < len(existingTerms); i++ {
+			if len(existingTerms[i].MatchExpressions) != 0 || len(existingTerms[i].MatchFields) != 0 {
+				hasExistingConstraints = true
+				break
+			}
+		}
+		if !hasExistingConstraints {
+			filteredTerms := make([]corev1.NodeSelectorTerm, 0, len(requiredSchedulingTerms))
+			for i := 0; i < len(requiredSchedulingTerms); i++ {
+				if len(requiredSchedulingTerms[i].MatchExpressions) == 0 && len(requiredSchedulingTerms[i].MatchFields) == 0 {
+					continue
+				}
+				filteredTerms = append(filteredTerms, requiredSchedulingTerms[i])
+			}
+			pod.Spec.Affinity.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms = filteredTerms
+			return
+		}
+		for i := 0; i < len(existingTerms); i++ {
+			if len(existingTerms[i].MatchExpressions) == 0 && len(existingTerms[i].MatchFields) == 0 {
+				continue
+			}
+			for j := 0; j < len(requiredSchedulingTerms); j++ {
+				if len(requiredSchedulingTerms[j].MatchExpressions) == 0 && len(requiredSchedulingTerms[j].MatchFields) == 0 {
+					continue
+				}
+				combinedTerm := corev1.NodeSelectorTerm{
+					MatchExpressions: append(append([]corev1.NodeSelectorRequirement{}, existingTerms[i].MatchExpressions...), requiredSchedulingTerms[j].MatchExpressions...),
+					MatchFields:      append(append([]corev1.NodeSelectorRequirement{}, existingTerms[i].MatchFields...), requiredSchedulingTerms[j].MatchFields...),
+				}
+				combinedTerms = append(combinedTerms, combinedTerm)
+			}
+		}
+		if len(combinedTerms) == 0 {
+			return
 		}
+		pod.Spec.Affinity.NodeAffinity.RequiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms = combinedTerms
 	}
 
 }