cluster image validation: allow only simplyblock docker images

api/v1alpha1/controlplane_types.go

@@ -26,7 +26,9 @@ type ControlPlaneSpec struct {
 	// Image is the container image used for all simplyblock control-plane and
 	// storage-node workloads (e.g. quay.io/simplyblock-io/simplyblock:26.2.2).
 	// StorageNode CRs that omit spec.clusterImage inherit this value.
+	// Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
 	// +optional
+	// +kubebuilder:validation:Pattern=`^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$`
 	Image string `json:"image,omitempty"`
 }
 

api/v1alpha1/storagenode_types.go

@@ -39,6 +39,8 @@ type StorageNodeSpec struct {
 	ClusterName string `json:"clusterName"`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Cluster Image"
 	// ClusterImage is the container image used for storage-node workloads.
+	// Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+	// +kubebuilder:validation:Pattern=`^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$`
 	ClusterImage string `json:"clusterImage,omitempty"`
 	// +kubebuilder:validation:Enum=shutdown;restart;suspend;resume;remove
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Action"
@@ -56,9 +58,13 @@ type StorageNodeSpec struct {
 	MaxSize string `json:"maxSize,omitempty"`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="SPDK Image"
 	// SpdkImage is the SPDK image reference used by node services.
+	// Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+	// +kubebuilder:validation:Pattern=`^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$`
 	SpdkImage string `json:"spdkImage,omitempty"`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="SPDK Proxy Image"
 	// SpdkProxyImage is the SPDK proxy image reference used by node services.
+	// Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+	// +kubebuilder:validation:Pattern=`^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$`
 	SpdkProxyImage string `json:"spdkProxyImage,omitempty"`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Management Interface"
 	// MgmtIfname is the management interface name used by storage nodes.

config/crd/bases/storage.simplyblock.io_controlplanes.yaml

@@ -62,6 +62,8 @@ spec:
                   Image is the container image used for all simplyblock control-plane and
                   storage-node workloads (e.g. quay.io/simplyblock-io/simplyblock:26.2.2).
                   StorageNode CRs that omit spec.clusterImage inherit this value.
+                  Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
             type: object
           status:

config/crd/bases/storage.simplyblock.io_storagenodes.yaml

@@ -49,8 +49,10 @@ spec:
                 - remove
                 type: string
               clusterImage:
-                description: ClusterImage is the container image used for storage-node
-                  workloads.
+                description: |-
+                  ClusterImage is the container image used for storage-node workloads.
+                  Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               clusterName:
                 description: ClusterName is the target storage cluster name.
@@ -158,11 +160,16 @@ spec:
                   type: string
                 type: array
               spdkImage:
-                description: SpdkImage is the SPDK image reference used by node services.
+                description: |-
+                  SpdkImage is the SPDK image reference used by node services.
+                  Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               spdkProxyImage:
-                description: SpdkProxyImage is the SPDK proxy image reference used
-                  by node services.
+                description: |-
+                  SpdkProxyImage is the SPDK proxy image reference used by node services.
+                  Must reference one of the trusted registries (quay.io/simplyblock-io, docker.io/simplyblock, public.ecr.aws/simply-block); digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               tolerations:
                 description: Tolerations configures pod tolerations for storage-node

config/samples/storage_v1alpha1_storagenode.yaml

@@ -7,7 +7,7 @@ metadata:
   name: storagenode-sample
 spec:
   clusterName: sample-cluster
-  clusterImage: simplyblock/snode:latest
+  clusterImage: quay.io/simplyblock-io/simplyblock:26.2.5-PRE
   maxLogicalVolumeCount: 256
   workerNodes:
     - worker-node-1

dist/install.yaml

@@ -1553,8 +1553,10 @@ spec:
                 - remove
                 type: string
               clusterImage:
-                description: ClusterImage is the container image used for storage-node
-                  workloads.
+                description: |-
+                  ClusterImage is the container image used for storage-node workloads.
+                  Must reference the quay.io/simplyblock-io registry; digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               clusterName:
                 description: ClusterName is the target storage cluster name.
@@ -1662,11 +1664,16 @@ spec:
                   type: string
                 type: array
               spdkImage:
-                description: SpdkImage is the SPDK image reference used by node services.
+                description: |-
+                  SpdkImage is the SPDK image reference used by node services.
+                  Must reference the quay.io/simplyblock-io registry; digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               spdkProxyImage:
-                description: SpdkProxyImage is the SPDK proxy image reference used
-                  by node services.
+                description: |-
+                  SpdkProxyImage is the SPDK proxy image reference used by node services.
+                  Must reference the quay.io/simplyblock-io registry; digest pinning (@sha256:...) is recommended.
+                pattern: ^($|(quay\.io/simplyblock-io|docker\.io/simplyblock|public\.ecr\.aws/simply-block)/[a-z0-9][a-z0-9._-]*:[a-zA-Z0-9][a-zA-Z0-9._-]*(@sha256:[a-f0-9]{64})?)$
                 type: string
               tolerations:
                 description: Tolerations configures pod tolerations for storage-node