Merge pull request #119296 from pohly/dra-pod-resource-claim-status-validation

dra API: ensure that pod status contains no duplicate resource claims

pkg/apis/core/validation/validation.go

@@ -4871,6 +4871,7 @@ func validatePodConditions(conditions []core.PodCondition, fldPath *field.Path)
 func validatePodResourceClaimStatuses(statuses []core.PodResourceClaimStatus, podClaims []core.PodResourceClaim, fldPath *field.Path) field.ErrorList {
 	var allErrs field.ErrorList
 
+	claimNames := sets.New[string]()
 	for i, status := range statuses {
 		idxPath := fldPath.Index(i)
 		// There's no need to check the content of the name. If it matches an entry,
@@ -4878,6 +4879,11 @@ func validatePodResourceClaimStatuses(statuses []core.PodResourceClaimStatus, po
 		if !havePodClaim(podClaims, status.Name) {
 			allErrs = append(allErrs, field.Invalid(idxPath.Child("name"), status.Name, "must match the name of an entry in `spec.resourceClaims`"))
 		}
+		if claimNames.Has(status.Name) {
+			allErrs = append(allErrs, field.Duplicate(idxPath.Child("name"), status.Name))
+		} else {
+			claimNames.Insert(status.Name)
+		}
 		if status.ResourceClaimName != nil {
 			for _, detail := range ValidateResourceClaimName(*status.ResourceClaimName, false) {
 				allErrs = append(allErrs, field.Invalid(idxPath.Child("name"), status.ResourceClaimName, detail))

pkg/apis/core/validation/validation_test.go

@@ -13675,6 +13675,37 @@ func TestValidatePodStatusUpdate(t *testing.T) {
 		},
 		`status.resourceClaimStatuses[0].name: Invalid value: "%$!#": a lowercase RFC 1123 subdomain must consist of`,
 		"Invalid ResourceClaim name",
+	}, {
+		core.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "foo",
+			},
+			Spec: core.PodSpec{
+				ResourceClaims: []core.PodResourceClaim{
+					{Name: "my-claim"},
+					{Name: "my-other-claim"},
+				},
+			},
+			Status: core.PodStatus{
+				ResourceClaimStatuses: []core.PodResourceClaimStatus{
+					{Name: "my-claim", ResourceClaimName: utilpointer.String("foo-my-claim-12345")},
+					{Name: "my-other-claim", ResourceClaimName: nil},
+					{Name: "my-other-claim", ResourceClaimName: nil},
+				},
+			},
+		},
+		core.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "foo",
+			},
+			Spec: core.PodSpec{
+				ResourceClaims: []core.PodResourceClaim{
+					{Name: "my-claim"},
+				},
+			},
+		},
+		`status.resourceClaimStatuses[2].name: Duplicate value: "my-other-claim"`,
+		"Duplicate ResourceClaimStatuses.Name",
 	}, {
 		core.Pod{
 			ObjectMeta: metav1.ObjectMeta{