operator: accept image SHA digests

[mythi]

No description provided.

[mythi]

@hj-johannes-lee please check this proposal and test it out

/cc @chaitanya1731

[codecov-commenter]

Codecov Report

Merging #1396 (a4cfb74) into main (f037c8b) will not change coverage.
The diff coverage is n/a.

❗ Current head a4cfb74 differs from pull request most recent head 5bab034. Consider uploading reports for the commit 5bab034 to get more accurate results

@@           Coverage Diff           @@
##             main    #1396   +/-   ##
=======================================
  Coverage   50.95%   50.95%           
=======================================
  Files          44       44           
  Lines        4985     4985           
=======================================
  Hits         2540     2540           
  Misses       2300     2300           
  Partials      145      145           

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[hj-johannes-lee]

For others also see, let me put the test results.

Before:

$ kubectl apply -f deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml 
Error from server (unable to parse version "@sha256:aa8a24770fa459fea7e8dea830d761c2a0435fcae76e4211712715a72a86e952": could not parse "@sha256:aa8a24770fa459fea7e8dea830d761c2a0435fcae76e4211712715a72a86e952" as version): error when creating "deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml": admission webhook "vdlbdeviceplugin.kb.io" denied the request: unable to parse version "@sha256:aa8a24770fa459fea7e8dea830d761c2a0435fcae76e4211712715a72a86e952": could not parse "@sha256:aa8a24770fa459fea7e8dea830d761c2a0435fcae76e4211712715a72a86e952" as version

After:

$ kubectl apply -f deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml 
dlbdeviceplugin.deviceplugin.intel.com/dlbdeviceplugin-sample created

In case of wrong image name:

$ kubectl apply -f deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml 
Error from server (incorrect image name "intel-dlb-initcontainer-wrong". Make sure you use '/intel-dlb-initcontainer.): error when creating "deployments/operator/samples/deviceplugin_v1_dlbdeviceplugin.yaml": admission webhook "vdlbdeviceplugin.kb.io" denied the request: incorrect image name "intel-dlb-initcontainer-wrong". Make sure you use '/intel-dlb-initcontainer'.

[chaitanya1731]

Similar test results on OCP too..

CRs deploy successfully with SHAs (correct image name and SHA).

For incorrect SHA length (random SHA key with length longer than expected) -

For incorrect image name -

For incorrect SHA (with correct SHA length) -

CR is deployed but cannot pull image which is expected.. gives ErrImagePull

[mythi]

@hj-johannes-lee @chaitanya1731 thanks! I improved the error handling / UX for the faulty SHA digests still. PTAL

[tkatila]

Looks good!

[chaitanya1731]

@mythi
Done some testing again and the errors messages looks much better now -

For incorrect SHA length

Fix the following errors:
admission webhook "vsgxdeviceplugin.kb.io" denied the request: unable to parse version "055aa2fd127920b5fe8cfd73f8c2df13080093f1eab3ae8b19db0ea4b10739b1sadsda". Make sure it's either valid SHA digest or semver tag.: illegal version string "055aa2fd127920b5fe8cfd73f8c2df13080093f1eab3ae8b19db0ea4b10739b1sadsda"

For incorrect image name

Fix the following errors:
admission webhook "vsgxdeviceplugin.kb.io" denied the request: incorrect image name "intel-sgx-plugin-wrong@sha256". Make sure you use '/intel-sgx-plugin'.