implement requested changes

Author: smg247

pkg/apis/testextension/v1/types.go

@@ -32,3 +32,13 @@ type TestExtensionAdmissionStatus struct {
 	// +optional
 	Conditions []metav1.Condition `json:"conditions,omitempty"`
 }
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestExtensionAdmissionList contains a list of TestExtensionAdmission
+type TestExtensionAdmissionList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestExtensionAdmission `json:"items"`
+}

pkg/cmd/openshift-tests/extension-admission/extension_admission_command.go

@@ -163,9 +163,9 @@ func (o *extensionAdmissionOptions) applyYAML(yamlBytes []byte) error {
 		return fmt.Errorf("failed to create temp file: %w", err)
 	}
 	defer os.Remove(tmpFile.Name())
-	defer tmpFile.Close()
 
 	if _, err := tmpFile.Write(yamlBytes); err != nil {
+		tmpFile.Close()
 		return fmt.Errorf("failed to write YAML to temp file: %w", err)
 	}
 	tmpFile.Close()

pkg/cmd/openshift-tests/extension-admission/testextensionadmission-crd.yaml

@@ -28,10 +28,11 @@ spec:
               properties:
                 permit:
                   type: array
-                  description: List of permitted ImageStream patterns in format "namespace/imagestream". Supports wildcards like "openshift/*", "*/*", or specific "namespace/stream"
+                  description: List of permitted ImageStream patterns in format "namespace/imagestream". Each segment must be either "*" (wildcard) or a valid name (no embedded wildcards). Examples - "openshift/*", "*/*", "namespace/stream"
+                  minItems: 1
                   items:
                     type: string
-                    pattern: '^[a-zA-Z0-9\*]([a-zA-Z0-9\-\_\*]*[a-zA-Z0-9\*])?/[a-zA-Z0-9\*]([a-zA-Z0-9\-\_\*]*[a-zA-Z0-9\*])?$'
+                    pattern: '^(\*|[a-zA-Z0-9]([-_a-zA-Z0-9]*[a-zA-Z0-9])?)/(\*|[a-zA-Z0-9]([-_a-zA-Z0-9]*[a-zA-Z0-9])?)$'
               required:
                 - permit
             status:

pkg/test/extensions/binary.go

@@ -1033,8 +1033,8 @@ func (s nonPayloadSource) imageTag() string {
 
 // discoverNonPayloadExtensions lists ImageStreamTags with ComponentAnnotation in all namespaces,
 // parses binary annotation and image ref, and splits into permitted vs unpermitted by the admission result.
-func discoverNonPayloadExtensions(ctx context.Context, oc *exutil.CLI, permitPatters []PermitPattern) (permitted []nonPayloadSource, unpermitted []UnpermittedExtension, err error) {
-	if len(permitPatters) == 0 {
+func discoverNonPayloadExtensions(ctx context.Context, oc *exutil.CLI, permitPatterns []PermitPattern) (permitted []nonPayloadSource, unpermitted []UnpermittedExtension, err error) {
+	if len(permitPatterns) == 0 {
 		return nil, nil, nil
 	}
 	imageClient := oc.AdminImageClient().ImageV1()
@@ -1076,7 +1076,7 @@ func discoverNonPayloadExtensions(ctx context.Context, oc *exutil.CLI, permitPat
 			Component:   component,
 			BinaryArgs:  binArgs,
 		}
-		if MatchesAnyPermit(namespace, streamName, permitPatters) {
+		if MatchesAnyPermit(namespace, streamName, permitPatterns) {
 			permitted = append(permitted, source)
 		} else {
 			unpermitted = append(unpermitted, UnpermittedExtension{

pkg/test/extensions/non-payload-binary-admission.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"github.com/sirupsen/logrus"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -117,10 +118,5 @@ func DiscoverNonPayloadBinaryAdmission(ctx context.Context, config *rest.Config)
 }
 
 func isNotFound(err error) bool {
-	if err == nil {
-		return false
-	}
-	return strings.Contains(err.Error(), "not found") ||
-		strings.Contains(err.Error(), "NotFound") ||
-		strings.Contains(err.Error(), "the server could not find the requested resource")
+	return apierrors.IsNotFound(err)
 }

pkg/test/extensions/provider.go

@@ -108,8 +108,17 @@ func (provider *ExternalBinaryProvider) extractBinary(imageRef, binaryPath, targ
 
 	// Check if the binary already exists in cache
 	if _, err := os.Stat(finalBinPath); err == nil {
-		logrus.Infof("Using existing binary %s for %s", finalBinPath, imageTag)
-		return finalBinPath, 0, nil
+		// Revalidate architecture compatibility before returning cached binary
+		if err := checkCompatibleArchitecture(finalBinPath); err != nil {
+			logrus.Warnf("Cached binary %s for %s is incompatible with current architecture, removing: %v", finalBinPath, imageTag, err)
+			if removeErr := os.Remove(finalBinPath); removeErr != nil {
+				logrus.Warnf("Failed to remove incompatible cached binary %s: %v", finalBinPath, removeErr)
+			}
+			// Continue with normal extraction flow
+		} else {
+			logrus.Infof("Using existing binary %s for %s", finalBinPath, imageTag)
+			return finalBinPath, 0, nil
+		}
 	}
 
 	// Start the extraction process
@@ -281,7 +290,7 @@ func cleanOldCacheFiles(dir string) {
 }
 
 func binaryPathOverride(imageTag, binaryPath string) string {
-	safeEnvVar := strings.NewReplacer("/", "_", "-", "_", ".", "_")
+	safeEnvVar := strings.NewReplacer("/", "_", "-", "_", ".", "_", ":", "_")
 
 	// Check for a specific override for this binary path, less common but allows supporting
 	// images that have multiple test binaries.

pkg/test/ginkgo/cmd_runsuite.go

@@ -191,16 +191,17 @@ func createUnpermittedExtensionTests(unpermitted []extensions.UnpermittedExtensi
 	if len(unpermitted) > 0 {
 		logrus.Warnf("Found %d unpermitted extension binary(ies)", len(unpermitted))
 
-		msg := "extension binary not permitted by TestExtensionAdmission:\n"
+		var msg strings.Builder
+		msg.WriteString("extension binary not permitted by TestExtensionAdmission:\n")
 		for _, u := range unpermitted {
-			msg = fmt.Sprintf("%s\n  - %s/%s:%s (%s)\n", msg, u.Namespace, u.ImageStream, u.Tag, u.Component)
+			fmt.Fprintf(&msg, "\n  - %s/%s:%s (%s)\n", u.Namespace, u.ImageStream, u.Tag, u.Component)
 			logrus.Warnf("  Unpermitted: %s/%s:%s (%s)", u.Namespace, u.ImageStream, u.Tag, u.Component)
 		}
 
 		testCases = append(testCases, &junitapi.JUnitTestCase{
 			Name: testName,
 			FailureOutput: &junitapi.FailureOutput{
-				Output: msg,
+				Output: msg.String(),
 			},
 		})
 	}