multus: thick: disallow using cni version <= 0.3.1 with >= 0.4.0

Similarly to disallowing incompatible versions in entrypoint.sh,
add the same logic in go for the thick plugin.

go.mod

@@ -3,6 +3,7 @@ module gopkg.in/k8snetworkplumbingwg/multus-cni.v3
 go 1.16
 
 require (
+	github.com/blang/semver v3.5.1+incompatible
 	github.com/containernetworking/cni v0.8.1
 	github.com/containernetworking/plugins v0.9.1
 	github.com/fsnotify/fsnotify v1.4.9

pkg/config/generator.go

@@ -17,12 +17,15 @@ package config
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"path/filepath"
 	"sort"
 	"strings"
 	"time"
+
+	"github.com/blang/semver"
 )
 
 const (
@@ -70,6 +73,39 @@ func NewMultusConfig(pluginName string, cniVersion string, kubeconfig string, co
 // Generate generates the multus configuration from whatever state is currently
 // held
 func (mc *MultusConf) Generate() (string, error) {
+	versionFmt := "delegate cni version is %s while top level cni version is %s"
+	v040, _ := semver.Make("0.4.0")
+	v031, _ := semver.Make("0.3.1")
+	topLevel, err := semver.Make(mc.CNIVersion)
+
+	if err != nil {
+		s := "Error in top level cni version"
+		return "", errors.New(s)
+	}
+
+	if topLevel.GTE(v040) {
+		for _, delegate := range mc.Delegates {
+			delegatesMap, ok := delegate.(map[string]interface{})
+			if !ok {
+				s := "Couldn't get cni version of delegate"
+				return "", errors.New(s)
+			}
+			delegateVersion, ok := delegatesMap["cniVersion"].(string)
+			if !ok {
+				s := "Couldn't get cni version of delegate"
+				return "", errors.New(s)
+			}
+			v, err := semver.Make(delegateVersion)
+			if err != nil {
+				return "", err
+			}
+			if v.LTE(v031) {
+				s := fmt.Sprintf(versionFmt, delegateVersion, mc.CNIVersion)
+				return "", errors.New(s)
+			}
+		}
+	}
+
 	data, err := json.Marshal(mc)
 	return string(data), err
 }

vendor/modules.txt

@@ -4,6 +4,7 @@ github.com/Microsoft/go-winio/pkg/guid
 # github.com/beorn7/perks v1.0.1
 github.com/beorn7/perks/quantile
 # github.com/blang/semver v3.5.1+incompatible
+## explicit
 github.com/blang/semver
 # github.com/cespare/xxhash/v2 v2.1.1
 github.com/cespare/xxhash/v2