Add DRA status feedback to hub-and-spoke ManifestWork

Add three DRA status feedback JSON path entries
(dra.availableNumber, dra.desiredNumber,
dra.nodesMatchingSelectorNumber) to the ManifestWork
feedback rules, mirroring the existing devicePlugin
pattern.

Validate DRA hostPath volumes against the same allowlist
(/dev, /sys, /var, /opt) used for DevicePlugin volumes,
ensuring the hub webhook rejects disallowed mounts before
they reach spoke clusters.

Author: TomerNewman

internal/manifestwork/manifestwork.go

@@ -37,6 +37,18 @@ var moduleStatusJSONPaths = []workv1.JsonPath{
 		Name: "devicePlugin.nodesMatchingSelectorNumber",
 		Path: ".status.devicePlugin.nodesMatchingSelectorNumber",
 	},
+	{
+		Name: "dra.availableNumber",
+		Path: ".status.dra.availableNumber",
+	},
+	{
+		Name: "dra.desiredNumber",
+		Path: ".status.dra.desiredNumber",
+	},
+	{
+		Name: "dra.nodesMatchingSelectorNumber",
+		Path: ".status.dra.nodesMatchingSelectorNumber",
+	},
 	{
 		Name: "moduleLoader.availableNumber",
 		Path: ".status.moduleLoader.availableNumber",

internal/manifestwork/manifestwork_test.go

@@ -26,6 +26,22 @@ var (
 	mockKM *module.MockKernelMapper
 )
 
+var _ = Describe("moduleStatusJSONPaths", func() {
+	It("should contain all expected status feedback paths", func() {
+		Expect(moduleStatusJSONPaths).To(ConsistOf(
+			workv1.JsonPath{Name: "devicePlugin.availableNumber", Path: ".status.devicePlugin.availableNumber"},
+			workv1.JsonPath{Name: "devicePlugin.desiredNumber", Path: ".status.devicePlugin.desiredNumber"},
+			workv1.JsonPath{Name: "devicePlugin.nodesMatchingSelectorNumber", Path: ".status.devicePlugin.nodesMatchingSelectorNumber"},
+			workv1.JsonPath{Name: "dra.availableNumber", Path: ".status.dra.availableNumber"},
+			workv1.JsonPath{Name: "dra.desiredNumber", Path: ".status.dra.desiredNumber"},
+			workv1.JsonPath{Name: "dra.nodesMatchingSelectorNumber", Path: ".status.dra.nodesMatchingSelectorNumber"},
+			workv1.JsonPath{Name: "moduleLoader.availableNumber", Path: ".status.moduleLoader.availableNumber"},
+			workv1.JsonPath{Name: "moduleLoader.desiredNumber", Path: ".status.moduleLoader.desiredNumber"},
+			workv1.JsonPath{Name: "moduleLoader.nodesMatchingSelectorNumber", Path: ".status.moduleLoader.nodesMatchingSelectorNumber"},
+		))
+	})
+})
+
 var _ = Describe("GarbageCollect", func() {
 	BeforeEach(func() {
 		ctrl = gomock.NewController(GinkgoT())

internal/webhook/module.go

@@ -163,6 +163,10 @@ func validateModule(mod *kmmv1beta1.Module, kubeVersion *KubeVersion) (admission
 		return nil, fmt.Errorf("failed to validate DRA: %v", err)
 	}
 
+	if err := validateDRAVolumes(mod.Spec.DRA); err != nil {
+		return nil, fmt.Errorf("failed to validate DRA volumes: %v", err)
+	}
+
 	if err := validateDevicePluginVolumes(mod.Spec.DevicePlugin); err != nil {
 		return nil, fmt.Errorf("failed to validate device plugin volumes: %v", err)
 	}
@@ -256,6 +260,23 @@ func validateDevicePluginVolumes(dp *kmmv1beta1.DevicePluginSpec) error {
 	return nil
 }
 
+func validateDRAVolumes(dra *kmmv1beta1.DRASpec) error {
+	if dra == nil {
+		return nil
+	}
+
+	for i, vol := range dra.Volumes {
+		if vol.HostPath != nil && !isAllowedHostPath(vol.HostPath.Path) {
+			return fmt.Errorf(
+				"spec.dra.volumes[%d]: hostPath %q is not allowed; only /dev, /sys, /var and /opt paths are permitted",
+				i, vol.HostPath.Path,
+			)
+		}
+	}
+
+	return nil
+}
+
 func validateImageFormat(img string) error {
 
 	if !strings.Contains(img, ":") && !strings.Contains(img, "@") {

internal/webhook/module_test.go

@@ -1009,3 +1009,83 @@ var _ = Describe("validateDevicePluginVolumes", func() {
 		Expect(validateDevicePluginVolumes(dp)).NotTo(HaveOccurred())
 	})
 })
+
+var _ = Describe("validateDRAVolumes", func() {
+	It("should accept nil DRA", func() {
+		Expect(validateDRAVolumes(nil)).NotTo(HaveOccurred())
+	})
+
+	It("should accept DRA with no volumes", func() {
+		dra := &kmmv1beta1.DRASpec{
+			Container:  kmmv1beta1.CommonContainerSpec{Image: "img:tag"},
+			DriverName: "example.com",
+		}
+		Expect(validateDRAVolumes(dra)).NotTo(HaveOccurred())
+	})
+
+	It("should accept non-hostPath volumes", func() {
+		dra := &kmmv1beta1.DRASpec{
+			Container:  kmmv1beta1.CommonContainerSpec{Image: "img:tag"},
+			DriverName: "example.com",
+			Volumes: []v1.Volume{
+				{
+					Name: "config",
+					VolumeSource: v1.VolumeSource{
+						ConfigMap: &v1.ConfigMapVolumeSource{
+							LocalObjectReference: v1.LocalObjectReference{Name: "my-cm"},
+						},
+					},
+				},
+			},
+		}
+		Expect(validateDRAVolumes(dra)).NotTo(HaveOccurred())
+	})
+
+	It("should accept hostPath volumes under /dev", func() {
+		dra := &kmmv1beta1.DRASpec{
+			Container:  kmmv1beta1.CommonContainerSpec{Image: "img:tag"},
+			DriverName: "example.com",
+			Volumes: []v1.Volume{
+				{
+					Name: "dev-vfio",
+					VolumeSource: v1.VolumeSource{
+						HostPath: &v1.HostPathVolumeSource{Path: "/dev/vfio"},
+					},
+				},
+			},
+		}
+		Expect(validateDRAVolumes(dra)).NotTo(HaveOccurred())
+	})
+
+	It("should reject hostPath volumes outside allowed paths", func() {
+		dra := &kmmv1beta1.DRASpec{
+			Container:  kmmv1beta1.CommonContainerSpec{Image: "img:tag"},
+			DriverName: "example.com",
+			Volumes: []v1.Volume{
+				{
+					Name: "root",
+					VolumeSource: v1.VolumeSource{
+						HostPath: &v1.HostPathVolumeSource{Path: "/"},
+					},
+				},
+			},
+		}
+		Expect(validateDRAVolumes(dra)).To(MatchError(ContainSubstring("not allowed")))
+	})
+
+	It("should reject hostPath with path traversal like /dev/../etc", func() {
+		dra := &kmmv1beta1.DRASpec{
+			Container:  kmmv1beta1.CommonContainerSpec{Image: "img:tag"},
+			DriverName: "example.com",
+			Volumes: []v1.Volume{
+				{
+					Name: "traversal",
+					VolumeSource: v1.VolumeSource{
+						HostPath: &v1.HostPathVolumeSource{Path: "/dev/../etc/shadow"},
+					},
+				},
+			},
+		}
+		Expect(validateDRAVolumes(dra)).To(MatchError(ContainSubstring("not allowed")))
+	})
+})