Ensure that ResourceClaim / ComputeDomain namespace are the same

Signed-off-by: Kevin Klues <[email protected]>

cmd/compute-domain-kubelet-plugin/computedomain.go

@@ -265,6 +265,22 @@ func (m *ComputeDomainManager) GetNodeIPs(ctx context.Context, cdUID string) ([]
 	return ips, nil
 }
 
+func (m *ComputeDomainManager) AssertComputeDomainNamespace(ctx context.Context, claimNamespace, cdUID string) error {
+	cd, err := m.GetComputeDomain(ctx, cdUID)
+	if err != nil {
+		return fmt.Errorf("error getting ComputeDomain: %w", err)
+	}
+	if cd == nil {
+		return fmt.Errorf("ComputeDomain not found: %s", cdUID)
+	}
+
+	if cd.Namespace != claimNamespace {
+		return fmt.Errorf("the ResourceClaim's namespace is different than the ComputeDomain's namespace")
+	}
+
+	return nil
+}
+
 func (m *ComputeDomainManager) AddNodeLabel(ctx context.Context, cdUID string) error {
 	node, err := m.config.clientsets.Core.CoreV1().Nodes().Get(ctx, m.config.flags.nodeName, metav1.GetOptions{})
 	if err != nil {

cmd/compute-domain-kubelet-plugin/device_state.go

@@ -378,6 +378,9 @@ func (s *DeviceState) applyComputeDomainChannelConfig(ctx context.Context, confi
 	// Create any necessary ComputeDomain channels and gather their CDI container edits.
 	for _, r := range results {
 		channel := s.allocatable[r.Device].Channel
+		if err := s.computeDomainManager.AssertComputeDomainNamespace(ctx, claim.Namespace, config.DomainID); err != nil {
+			return nil, fmt.Errorf("error asserting ComputeDomain's namespace: %w", err)
+		}
 		if err := s.computeDomainManager.AddNodeLabel(ctx, config.DomainID); err != nil {
 			return nil, fmt.Errorf("error adding Node label for ComputeDomain: %w", err)
 		}