Validate fields in IPPool objects upon creation and updates

[starbops]

IMPORTANT: Please do not create a Pull Request without creating an issue first.

Problem:

Solution:

If a user tries to configure the embedded DHCP server with a designated IP address, the IPPool validator will validate the input. The create/update requests will be rejected if:

• The server IP is not within the defined subnet
• The server IP is the same as the network IP or broadcast IP of the subnet
• The server IP is the same as the router IP (if exists)
• The server IP collides with any already-allocated IPs

Related Issue:

harvester/harvester#5065

Test plan:

1. Install the vm-dhcp-controller chart with the version containing the fix

   • For reviewers: build a custom image based on the branch and install it with the chart directly
   • For QAs: the fix has already merged and released in v0.2.0 and could be activated by installing the harvester-vm-dhcp-controller add-on with the following value content and enable it

     apiVersion: harvesterhci.io/v1beta1
     kind: Addon
     metadata:
       name: harvester-vm-dhcp-controller
       namespace: harvester-system
       labels:
         addon.harvesterhci.io/experimental: "true"
     spec:
       enabled: false
       repo: https://charts.harvesterhci.io
       version: "v0.2.0"
       chart: harvester-vm-dhcp-controller
       valuesContent: |
         image:
           tag: "v0.2.0"
         agent:
           image:
             tag: "v0.2.0"
         webhook:
           image:
             tag: "v0.2.0"
     

2. Create a VM Network (NAD) before creating any IPPool objects

3. Create an IPPool object with the server IP outside of the subnet (should be rejected by the webhook)

   $ cat <<EOF | kubectl apply -f -
   apiVersion: network.harvesterhci.io/v1alpha1
   kind: IPPool
   metadata:
     namespace: default
     name: test-net
   spec:
     ipv4Config:
       serverIP: 172.18.100.100
       cidr: 172.19.0.0/16
       pool:
         start: 172.19.0.2
         end: 172.19.254.254
       router: 172.19.100.254
       leaseTime: 300
     networkName: default/test-net
   EOF
   
   Error from server (InternalError): error when creating "STDIN": admission webhook "validator.harvester-system.harvester-vm-dhcp-controller-webhook" denied the request: Internal error occurred: could not create IPPool default/test-net because server ip 172.18.100.100 is not within subnet
   

4. Modify the .spec.serverIP to the same IP as the network IP, broadcast IP, and router IP, then try to create it with the manifest (all should be rejected by the webhook)

5. Modify the .spec.serverIP to a sane IP address, i.e., within the subnet, but not collide with the network IP, broadcast IP, or router IP, then create it with the manifest (this should be successful)

6. Create a VM attaching to the VM Network, which should have the vmnetcfg object created under the hood

7. Check the IPPool object to see which IP address is allocated to the VM's interface (under .status.ipv4.allocated)

8. Modify the .spec.serverIP of the IPPool object, updating it to the VM's IP (should be rejected by the webhook)

[ibrokethecloud]

lgtm. thanks.

[starbops]

The recent commits address invalid user inputs not only limited to the serverIP field but also other mandatory fields, using CRD validation marks (thanks to @ibrokethecloud) and some custom logic implemented in the validating webhook.

[w13915984028]

LGTM, thanks.

[starbops]

Merge conflict resolved.

[ibrokethecloud]

lgtm. thanks.