🦺 Add validation for mounted files

pkg/api/v1alpha1/capsule_webhook.go

@@ -49,8 +49,22 @@ func (r *Capsule) ValidateDelete() (admission.Warnings, error) {
 }
 
 func (r *Capsule) validate() (admission.Warnings, error) {
-	warns, errs := r.validateInterfaces()
-	return warns, errs.ToAggregate()
+	var (
+		allWarns admission.Warnings
+		allErrs  field.ErrorList
+		warns    admission.Warnings
+		errs     field.ErrorList
+	)
+
+	warns, errs = r.validateInterfaces()
+	allWarns = append(allWarns, warns...)
+	allErrs = append(allErrs, errs...)
+
+	warns, errs = r.validateFiles()
+	allWarns = append(allWarns, warns...)
+	allErrs = append(allErrs, errs...)
+
+	return allWarns, allErrs.ToAggregate()
 }
 
 func (r *Capsule) validateInterfaces() (admission.Warnings, field.ErrorList) {
@@ -94,6 +108,26 @@ func (r *Capsule) validateInterfaces() (admission.Warnings, field.ErrorList) {
 }
 
 func (r *Capsule) validateFiles() (admission.Warnings, field.ErrorList) {
-	// TODO
-	return nil, nil
+	var errs field.ErrorList
+
+	paths := map[string]struct{}{}
+	filesPath := field.NewPath("spec").Child("files")
+	for i, f := range r.Spec.Files {
+		fPath := filesPath.Index(i)
+
+		if _, ok := paths[f.Path]; ok {
+			errs = append(errs, field.Duplicate(fPath.Child("path"), f.Path))
+		} else {
+			paths[f.Path] = struct{}{}
+		}
+
+		if f.Secret != nil && f.ConfigMap != nil {
+			errs = append(errs, field.Invalid(fPath, f, "configMap and secret are mutually exclusive"))
+		}
+		if f.Secret == nil && f.ConfigMap == nil {
+			errs = append(errs, field.Required(fPath, "one of configMap or secret is required"))
+		}
+	}
+
+	return nil, errs
 }

pkg/api/v1alpha1/capsule_webhook_test.go

@@ -87,3 +87,70 @@ func TestValidateInterfaces(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateFiles(t *testing.T) {
+	t.Parallel()
+	path := field.NewPath("spec").Child("files")
+	tests := []struct {
+		name         string
+		files        []File
+		expectedErrs field.ErrorList
+	}{
+		{name: "no files should cause no errors"},
+		{
+			name: "path should be unique",
+			files: []File{
+				{Path: "/test", ConfigMap: &FileContentRef{}},
+				{Path: "/test", ConfigMap: &FileContentRef{}},
+			},
+			expectedErrs: field.ErrorList{
+				field.Duplicate(path.Index(1).Child("path"), "/test"),
+			},
+		},
+		{
+			name: "configMap and secret are mutually exclusive",
+			files: []File{
+				{
+					Path:      "/test",
+					ConfigMap: &FileContentRef{},
+					Secret:    &FileContentRef{},
+				},
+			},
+			expectedErrs: field.ErrorList{
+				field.Invalid(path.Index(0), File{
+					Path:      "/test",
+					ConfigMap: &FileContentRef{},
+					Secret:    &FileContentRef{},
+				}, "configMap and secret are mutually exclusive"),
+			},
+		},
+		{
+			name: "one of configMap or secret is required",
+			files: []File{
+				{
+					Path: "/test",
+				},
+			},
+			expectedErrs: field.ErrorList{
+				field.Required(path.Index(0), "one of configMap or secret is required"),
+			},
+		},
+	}
+
+	for i := range tests {
+		test := tests[i]
+
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			c := &Capsule{
+				Spec: CapsuleSpec{
+					Files: test.files,
+				},
+			}
+
+			_, err := c.validateFiles()
+			assert.Equal(t, test.expectedErrs, err)
+		})
+	}
+}