fix(vi): validate storage class

images/virtualization-artifact/pkg/controller/moduleconfig/moduleconfig_webhook.go

@@ -46,6 +46,7 @@ func NewModuleConfigValidator(client client.Client) *validator.Validator[*mcapi.
 
 	cidrs := newCIDRsValidator(client)
 	reduceCIDRs := newRemoveCIDRsValidator(client)
+	viStorageClasses := newViStorageClassValidator(client)
 
 	return validator.NewValidator[*mcapi.ModuleConfig](logger).
 		WithPredicate(&validator.Predicate[*mcapi.ModuleConfig]{
@@ -54,5 +55,5 @@ func NewModuleConfigValidator(client client.Client) *validator.Validator[*mcapi.
 					oldMC.GetGeneration() != newMC.GetGeneration()
 			},
 		}).
-		WithUpdateValidators(cidrs, reduceCIDRs)
+		WithUpdateValidators(cidrs, reduceCIDRs, viStorageClasses)
 }

images/virtualization-artifact/pkg/controller/moduleconfig/vi_storageclass_validator.go

@@ -0,0 +1,123 @@
+/*
+Copyright 2025 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package moduleconfig
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	corev1 "k8s.io/api/core/v1"
+	cdiv1 "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	mcapi "github.com/deckhouse/virtualization-controller/pkg/controller/moduleconfig/api"
+)
+
+type viStorageClassValidator struct {
+	client client.Client
+}
+
+func newViStorageClassValidator(client client.Client) *viStorageClassValidator {
+	return &viStorageClassValidator{
+		client: client,
+	}
+}
+
+func (v viStorageClassValidator) ValidateUpdate(ctx context.Context, _, newMC *mcapi.ModuleConfig) (admission.Warnings, error) {
+	warnings := make([]string, 0)
+
+	viScSettings := parseViStorageClass(newMC.Spec.Settings)
+	if viScSettings.DefaultStorageClassName != "" {
+		scWarnings, err := v.validateStorageClass(ctx, viScSettings.DefaultStorageClassName)
+		if err != nil {
+			return warnings, err
+		}
+		if len(scWarnings) != 0 {
+			warnings = append(warnings, scWarnings...)
+		}
+	}
+
+	if len(viScSettings.AllowedStorageClassSelector.MatchNames) != 0 {
+		for _, sc := range viScSettings.AllowedStorageClassSelector.MatchNames {
+			scWarnings, err := v.validateStorageClass(ctx, sc)
+			if err != nil {
+				return warnings, err
+			}
+			if len(scWarnings) != 0 {
+				warnings = append(warnings, scWarnings...)
+			}
+		}
+	}
+
+	return admission.Warnings{}, nil
+}
+
+func (v viStorageClassValidator) validateStorageClass(ctx context.Context, scName string) (admission.Warnings, error) {
+	scProfile := &cdiv1.StorageProfile{}
+	err := v.client.Get(ctx, client.ObjectKey{Name: scName}, scProfile, &client.GetOptions{})
+	if err != nil {
+		return admission.Warnings{}, fmt.Errorf("failed to fetch the storage profile %s: %w", scName, err)
+	}
+	if len(scProfile.Status.ClaimPropertySets) == 0 {
+		return admission.Warnings{}, fmt.Errorf("failed to validate claim property sets of the storage profile`: %s", scName)
+	}
+
+	for _, cps := range scProfile.Status.ClaimPropertySets {
+		if slices.Contains(cps.AccessModes, corev1.ReadWriteMany) && *cps.VolumeMode == corev1.PersistentVolumeBlock {
+			return admission.Warnings{}, nil
+		}
+	}
+
+	return admission.Warnings{}, fmt.Errorf(
+		"the storage class %q lacks of capabilities to support 'Virtual Images on PVC' function; use StorageClass that supports volume mode 'Block' and access mode 'ReadWriteMany'",
+		scName,
+	)
+}
+
+type viStorageClassSettings struct {
+	DefaultStorageClassName     string
+	AllowedStorageClassSelector AllowedStorageClassSelector
+}
+
+type AllowedStorageClassSelector struct {
+	MatchNames []string
+}
+
+func parseViStorageClass(settings mcapi.SettingsValues) *viStorageClassSettings {
+	viScSettings := &viStorageClassSettings{}
+	if virtualImages, ok := settings["virtualImages"].(map[string]interface{}); ok {
+		if defaultClass, ok := virtualImages["defaultStorageClassName"].(string); ok {
+			viScSettings.DefaultStorageClassName = defaultClass
+		}
+
+		if allowedSelector, ok := virtualImages["allowedStorageClassSelector"].(map[string]interface{}); ok {
+			if matchNames, ok := allowedSelector["matchNames"].([]interface{}); ok {
+				var matchNameStrings []string
+				for _, name := range matchNames {
+					if strName, ok := name.(string); ok {
+						matchNameStrings = append(matchNameStrings, strName)
+					}
+				}
+				viScSettings.AllowedStorageClassSelector.MatchNames = matchNameStrings
+			}
+		}
+	}
+
+	return viScSettings
+}

images/virtualization-artifact/pkg/controller/service/base_storage_class_service.go

@@ -23,6 +23,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	storagev1 "k8s.io/api/storage/v1"
 	"k8s.io/apimachinery/pkg/types"
+	cdiv1 "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/deckhouse/virtualization-controller/pkg/common/annotations"
@@ -79,3 +80,7 @@ func (s BaseStorageClassService) GetPersistentVolumeClaim(ctx context.Context, s
 func (s BaseStorageClassService) IsStorageClassDeprecated(sc *storagev1.StorageClass) bool {
 	return sc != nil && sc.Labels["module"] == "local-path-provisioner"
 }
+
+func (s BaseStorageClassService) GetStorageProfile(ctx context.Context, name string) (*cdiv1.StorageProfile, error) {
+	return object.FetchObject(ctx, types.NamespacedName{Name: name}, s.client, &cdiv1.StorageProfile{})
+}

images/virtualization-artifact/pkg/controller/vi/internal/interfaces.go

@@ -21,6 +21,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 	storagev1 "k8s.io/api/storage/v1"
+	cdiv1 "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1"
 
 	"github.com/deckhouse/virtualization-controller/pkg/controller/supplements"
 	"github.com/deckhouse/virtualization-controller/pkg/controller/vi/internal/source"
@@ -45,6 +46,8 @@ type StorageClassService interface {
 	GetModuleStorageClass(ctx context.Context) (*storagev1.StorageClass, error)
 	GetDefaultStorageClass(ctx context.Context) (*storagev1.StorageClass, error)
 	GetStorageClass(ctx context.Context, sc string) (*storagev1.StorageClass, error)
+	GetStorageProfile(ctx context.Context, name string) (*cdiv1.StorageProfile, error)
 	GetPersistentVolumeClaim(ctx context.Context, sup *supplements.Generator) (*corev1.PersistentVolumeClaim, error)
 	IsStorageClassDeprecated(sc *storagev1.StorageClass) bool
+	ValidateClaimPropertySets(sp *cdiv1.StorageProfile) error
 }

images/virtualization-artifact/pkg/controller/vi/internal/service/vi_storage_class_service.go

@@ -19,9 +19,12 @@ package service
 import (
 	"context"
 	"errors"
+	"fmt"
 	"slices"
 
+	corev1 "k8s.io/api/core/v1"
 	storev1 "k8s.io/api/storage/v1"
+	cdiv1 "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1"
 
 	"github.com/deckhouse/virtualization-controller/pkg/config"
 	"github.com/deckhouse/virtualization-controller/pkg/controller/service"
@@ -117,3 +120,20 @@ func (svc *VirtualImageStorageClassService) IsStorageClassAllowed(scName string)
 func (svc *VirtualImageStorageClassService) GetModuleStorageClass(ctx context.Context) (*storev1.StorageClass, error) {
 	return svc.GetStorageClass(ctx, svc.storageClassSettings.DefaultStorageClassName)
 }
+
+func (svc *VirtualImageStorageClassService) ValidateClaimPropertySets(sp *cdiv1.StorageProfile) error {
+	if sp == nil {
+		return fmt.Errorf("the storage profile cannot be nil; please report a bug")
+	}
+
+	for _, cps := range sp.Status.ClaimPropertySets {
+		if slices.Contains(cps.AccessModes, corev1.ReadWriteMany) && *cps.VolumeMode == corev1.PersistentVolumeBlock {
+			return nil
+		}
+	}
+
+	return fmt.Errorf(
+		"the storage class %q lacks of capabilities to support 'Virtual Images on PVC' function; use StorageClass that supports volume mode 'Block' and access mode 'ReadWriteMany'",
+		sp.Name,
+	)
+}