Validate multicluster access provider paths

Signed-off-by: kahirokunn <okinakahiro@gmail.com>

Author: kahirokunn

config/charts/knative-operator/templates/access-providers-config.yaml

@@ -18,16 +18,26 @@
 {{-   fail "knative_operator.multicluster.enabled is true but knative_operator.multicluster.accessProvidersConfig is empty; either provide an access-providers config or disable multi-cluster support" }}
 {{- end }}
 {{- $mountPaths := list }}
-{{- range ($mc.plugins | default (list)) }}
-{{-   $mountPaths = append $mountPaths .mountPath }}
+{{- range $index, $plugin := ($mc.plugins | default (list)) }}
+{{-   $mountPath := $plugin.mountPath | default "" | toString | clean }}
+{{-   if not (hasPrefix "/" $mountPath) }}
+{{-     fail (printf "knative_operator.multicluster.plugins[%d].mountPath must be an absolute path, got %q" $index ($plugin.mountPath | default "" | toString)) }}
+{{-   end }}
+{{-   $mountPaths = append $mountPaths $mountPath }}
 {{- end }}
 {{- $cfg := $mc.accessProvidersConfig | default dict }}
 {{- range ($cfg.providers | default (list)) }}
-{{-   $cmd := (.execConfig | default dict).command | default "" }}
-{{-   if $cmd }}
-{{-     $cmdDir := dir $cmd }}
-{{-     if not (has $cmdDir $mountPaths) }}
-{{-       fail (printf "provider %q: command dir %q does not match any plugins[].mountPath %v" .name $cmdDir $mountPaths) }}
+{{-   $rawCmd := (.execConfig | default dict).command | default "" | toString }}
+{{-   $cmd := $rawCmd | clean }}
+{{-   if $rawCmd }}
+{{-     $matched := false }}
+{{-     range $mountPath := $mountPaths }}
+{{-       if hasPrefix (printf "%s/" $mountPath) $cmd }}
+{{-         $matched = true }}
+{{-       end }}
+{{-     end }}
+{{-     if not $matched }}
+{{-       fail (printf "provider %q: command %q is not under any plugins[].mountPath %v" .name $cmd $mountPaths) }}
 {{-     end }}
 {{-   end }}
 {{- end }}

config/charts/knative-operator/templates/operator.yaml

@@ -867,9 +867,13 @@ spec:
             - name: access-config
               mountPath: /etc/cluster-inventory
               readOnly: true
-{{- range ($mc.plugins | default list) }}
+{{- range $index, $plugin := ($mc.plugins | default list) }}
+{{- $mountPath := $plugin.mountPath | default "" | toString | clean }}
+{{- if not (hasPrefix "/" $mountPath) }}
+{{-   fail (printf "knative_operator.multicluster.plugins[%d].mountPath must be an absolute path, got %q" $index ($plugin.mountPath | default "" | toString)) }}
+{{- end }}
             - name: {{ .name }}
-              mountPath: {{ .mountPath }}
+              mountPath: {{ $mountPath }}
               readOnly: true
 {{- end }}
 {{- end }}

config/charts/knative-operator/values.yaml

@@ -17,7 +17,8 @@ knative_operator:
     #         command: /access-plugins/kubeconfig-secretreader/bin/kubeconfig-secretreader-plugin
     #         interactiveMode: Never
     #         provideClusterInfo: true
-    # plugins[] uses the Kubernetes "image" volume type
+    # plugins[] uses the Kubernetes "image" volume type. Each mountPath must be
+    # absolute, and each execConfig.command must point under one of these paths.
     plugins: []
     # plugins:
     #   - name: secretreader

docs/multicluster.md

@@ -74,7 +74,9 @@ knative_operator:
 ```
 
 The chart creates a `ConfigMap` with the provider config and mounts each
-plugin as a Kubernetes image volume inside the operator pod.
+plugin as a Kubernetes image volume inside the operator pod. Each
+`plugins[].mountPath` must be absolute, and each `execConfig.command` must
+point under a plugin mount path, not at the mount directory itself.
 
 ## Namespace configuration