Disable host process containers when disable unsafe operations is enabled

[katiewasnothere]

Host process containers are not safe for multi-tenant scenarios since they run directly on the host and use the host's network. Don't allow host process containers to be used when DisableUnsafeOperations is set.

[anmaxvl]

shouldn't this be set to false, when disable unsafe annotations is true?

[helsaawy]

oh yeah, i missed that
either an annotation for DisableHostProcessContainer needs to be created, or we need an AnnotationDenyList thingy

[katiewasnothere]

@helsaawy I added a DisableHostProcessContainer annotation and updated the PR

[katiewasnothere]

@helsaawy and @anmaxvl I reworked this PR to instead change how we handle annotation expanding. Instead of the annotations sharing the same value as the parent annotation, I added the ability to set a target value for the child annotations. Do y'all have any thoughts on this approach?

Note: optionally in the future we could even expand this to use parent annotations that are not true or false. For example, I could envision an annotation like "memorybacking" and when that annotation's value is "physical" then it could expand with child annotations allowovercommit to false and vpmemdevicecount to 0, like we have for the annotation "fullyphysicallybacked"

[helsaawy]

i think this implementation breaks the logic where we assume that parent annotation's must match the value of their expansions, and don't try to parse values as booleans.
i would rather we either:

1. double down on the bool approach, and have AnnotationExpansions be map[string]map[string]bool; or
2. add an DisableHostProcessContainer that is the antithesis of the HostProcessContainer annotation, with a separate check after annotation expansion that only one of the two can be defined

[helsaawy]

since we are already changing the type, which is breaking, can we make it:

Suggested change

	var AnnotationExpansions = map[string]map[string]string{
	func AnnotationExpansions() map[string]map[string]string {

that way, no-one can (inadvertently) modify the map

[katiewasnothere]

Could we just make it a const instead?

[helsaawy]

lgtm

[anmaxvl]

This is probably the only annotation that needs to be handled like this for now. In the future we may want to consider defining a "conflict annotations map" or similar, e.g.

conflictingAnnotations := map[string]string{
    annotations.DisableHostProcessContainer: annotations.HostProcessContainer,
}

for k, v := range conflictingAnnotations {
    v1 := ParseAnnotationsBool(ctx, s.Annotations, k, false)
    v2 := ParseAnnotationsBool(ctx, s.Annotations, v, false)
    if v1 && v2 {
        // handle conflict
    }
}

Maybe it's worth just doing it now too, rather than special casing it to HPC? thoughts?

[anmaxvl]

lgtm. my comment is non blocking