Repository: kubernetes-sigs/kernel-module-management
Pull request #1078: Refactor the way we get hash and build args for the build/sign flows.
Author: login: ybettan
Labels: name: size/L
description: Denotes a PR that changes 100-499 lines, ignoring generated files.
name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
name: lgtm
description: "Looks good to me", indicates that a PR is ready to be merged.
name: cncf-cla: yes
description: Indicates the PR's author has signed the CNCF CLA.
Created: 2025-04-10T07:43:26Z | Merged: 2025-04-10T09:18:47Z

---

/assign @yevgeny-shnaidman

This is a multi commit (2 commits) PR. Each commit contains its own commit message and the commits will be merged as is (not squashed by Github).

It contains 3 commits:
* Refactoring the way we get the hash annotation for build/sign.
* Refactoring the way we generate the container args for the build pod.
* Renaming the method object name for BuildSignPodManager.


Diff:
diff --git a/internal/buildsign/pod/buildsignpodmanager.go b/internal/buildsign/pod/buildsignpodmanager.go
index f297c5178..998f56565 100644
--- a/internal/buildsign/pod/buildsignpodmanager.go
+++ b/internal/buildsign/pod/buildsignpodmanager.go
@@ -61,7 +61,7 @@ func NewBuildSignPodManager(client client.Client, combiner module.Combiner, sche
 	}
 }
 
-func (mp *buildSignPodManager) IsPodChanged(existingPod *v1.Pod, newPod *v1.Pod) (bool, error) {
+func (bspm *buildSignPodManager) IsPodChanged(existingPod *v1.Pod, newPod *v1.Pod) (bool, error) {
 	existingAnnotations := existingPod.GetAnnotations()
 	newAnnotations := newPod.GetAnnotations()
 	if existingAnnotations == nil {
@@ -73,7 +73,7 @@ func (mp *buildSignPodManager) IsPodChanged(existingPod *v1.Pod, newPod *v1.Pod)
 	return true, nil
 }
 
-func (mp *buildSignPodManager) PodLabels(modName string, targetKernel string, podType string) map[string]string {
+func (bspm *buildSignPodManager) PodLabels(modName string, targetKernel string, podType string) map[string]string {
 	labels := moduleKernelLabels(modName, targetKernel, podType)
 
 	labels["app.kubernetes.io/name"] = "kmm"
@@ -83,9 +83,9 @@ func (mp *buildSignPodManager) PodLabels(modName string, targetKernel string, po
 	return labels
 }
 
-func (mp *buildSignPodManager) GetModulePodByKernel(ctx context.Context, modName, namespace, targetKernel, podType string, owner metav1.Object) (*v1.Pod, error) {
+func (bspm *buildSignPodManager) GetModulePodByKernel(ctx context.Context, modName, namespace, targetKernel, podType string, owner metav1.Object) (*v1.Pod, error) {
 	matchLabels := moduleKernelLabels(modName, targetKernel, podType)
-	pods, err := mp.getPods(ctx, namespace, matchLabels)
+	pods, err := bspm.getPods(ctx, namespace, matchLabels)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get module %s, pods by kernel %s: %v", modName, targetKernel, err)
 	}
@@ -103,9 +103,9 @@ func (mp *buildSignPodManager) GetModulePodByKernel(ctx context.Context, modName
 	return &moduleOwnedPods[0], nil
 }
 
-func (mp *buildSignPodManager) GetModulePods(ctx context.Context, modName, namespace, podType string, owner metav1.Object) ([]v1.Pod, error) {
+func (bspm *buildSignPodManager) GetModulePods(ctx context.Context, modName, namespace, podType string, owner metav1.Object) ([]v1.Pod, error) {
 	matchLabels := moduleLabels(modName, podType)
-	pods, err := mp.getPods(ctx, namespace, matchLabels)
+	pods, err := bspm.getPods(ctx, namespace, matchLabels)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get pods for module %s, namespace %s: %v", modName, namespace, err)
 	}
@@ -116,19 +116,19 @@ func (mp *buildSignPodManager) GetModulePods(ctx context.Context, modName, names
 	return moduleOwnedPods, nil
 }
 
-func (mp *buildSignPodManager) DeletePod(ctx context.Context, pod *v1.Pod) error {
+func (bspm *buildSignPodManager) DeletePod(ctx context.Context, pod *v1.Pod) error {
 	opts := []client.DeleteOption{
 		client.PropagationPolicy(metav1.DeletePropagationBackground),
 	}
-	err := mp.client.Delete(ctx, pod, opts...)
+	err := bspm.client.Delete(ctx, pod, opts...)
 	if err != nil {
 		return err
 	}
 	return nil
 }
 
-func (mp *buildSignPodManager) CreatePod(ctx context.Context, pod *v1.Pod) error {
-	err := mp.client.Create(ctx, pod)
+func (bspm *buildSignPodManager) CreatePod(ctx context.Context, pod *v1.Pod) error {
+	err := bspm.client.Create(ctx, pod)
 	if err != nil {
 		return err
 	}
@@ -137,7 +137,7 @@ func (mp *buildSignPodManager) CreatePod(ctx context.Context, pod *v1.Pod) error
 
 // GetPodStatus returns the status of a Pod, whether the latter is in progress or not and
 // whether there was an error or not
-func (mp *buildSignPodManager) GetPodStatus(pod *v1.Pod) (Status, error) {
+func (bspm *buildSignPodManager) GetPodStatus(pod *v1.Pod) (Status, error) {
 	switch pod.Status.Phase {
 	case v1.PodSucceeded:
 		return StatusCompleted, nil
@@ -150,13 +150,13 @@ func (mp *buildSignPodManager) GetPodStatus(pod *v1.Pod) (Status, error) {
 	}
 }
 
-func (mp *buildSignPodManager) getPods(ctx context.Context, namespace string, labels map[string]string) ([]v1.Pod, error) {
+func (bspm *buildSignPodManager) getPods(ctx context.Context, namespace string, labels map[string]string) ([]v1.Pod, error) {
 	podList := v1.PodList{}
 	opts := []client.ListOption{
 		client.MatchingLabels(labels),
 		client.InNamespace(namespace),
 	}
-	if err := mp.client.List(ctx, &podList, opts...); err != nil {
+	if err := bspm.client.List(ctx, &podList, opts...); err != nil {
 		return nil, fmt.Errorf("could not list pods: %v", err)
 	}
 
@@ -186,7 +186,7 @@ func filterPodsByOwner(pods []v1.Pod, owner metav1.Object) []v1.Pod {
 	return ownedPods
 }
 
-func (mp *buildSignPodManager) MakeBuildResourceTemplate(ctx context.Context, mld *api.ModuleLoaderData, owner metav1.Object,
+func (bspm *buildSignPodManager) MakeBuildResourceTemplate(ctx context.Context, mld *api.ModuleLoaderData, owner metav1.Object,
 	pushImage bool) (*v1.Pod, error) {
 
 	// if build AND sign are specified, then we will build an intermediate image
@@ -196,8 +196,8 @@ func (mp *buildSignPodManager) MakeBuildResourceTemplate(ctx context.Context, ml
 		containerImage = module.IntermediateImageName(mld.Name, mld.Namespace, containerImage)
 	}
 
-	podSpec := mp.podSpec(mld, containerImage, pushImage)
-	podSpecHash, err := mp.getBuildHashAnnotationValue(
+	podSpec := bspm.podSpec(mld, containerImage, pushImage)
+	podSpecHash, err := bspm.getBuildHashAnnotationValue(
 		ctx,
 		mld.Build.DockerfileConfigMap.Name,
 		mld.Namespace,
@@ -211,21 +211,21 @@ func (mp *buildSignPodManager) MakeBuildResourceTemplate(ctx context.Context, ml
 		ObjectMeta: metav1.ObjectMeta{
 			GenerateName: mld.Name + "-build-",
 			Namespace:    mld.Namespace,
-			Labels:       mp.PodLabels(mld.Name, mld.KernelNormalizedVersion, PodTypeBuild),
+			Labels:       bspm.PodLabels(mld.Name, mld.KernelNormalizedVersion, PodTypeBuild),
 			Annotations:  map[string]string{constants.PodHashAnnotation: fmt.Sprintf("%d", podSpecHash)},
 			Finalizers:   []string{constants.GCDelayFinalizer, constants.JobEventFinalizer},
 		},
 		Spec: podSpec,
 	}
 
-	if err := controllerutil.SetControllerReference(owner, pod, mp.scheme); err != nil {
+	if err := controllerutil.SetControllerReference(owner, pod, bspm.scheme); err != nil {
 		return nil, fmt.Errorf("could not set the owner reference: %v", err)
 	}
 
 	return pod, nil
 }
 
-func (mp *buildSignPodManager) MakeSignResourceTemplate(ctx context.Context, mld *api.ModuleLoaderData, owner metav1.Object,
+func (bspm *buildSignPodManager) MakeSignResourceTemplate(ctx context.Context, mld *api.ModuleLoaderData, owner metav1.Object,
 	pushImage bool) (*v1.Pod, error) {
 
 	signConfig := mld.Sign
@@ -242,20 +242,7 @@ func (mp *buildSignPodManager) MakeSignResourceTemplate(ctx context.Context, mld
 		imageToSign = module.IntermediateImageName(mld.Name, mld.Namespace, mld.ContainerImage)
 	}
 
-	args := make([]string, 0)
-
-	if pushImage {
-		args = append(args, "--destination", mld.ContainerImage)
-
-		if mld.RegistryTLS.Insecure {
-			args = append(args, "--insecure")
-		}
-		if mld.RegistryTLS.InsecureSkipTLSVerify {
-			args = append(args, "--skip-tls-verify")
-		}
-	} else {
-		args = append(args, "-no-push")
-	}
+	args := bspm.containerArgs(mld, mld.ContainerImage, signConfig.UnsignedImageRegistryTLS, pushImage)
 
 	if imageToSign != "" {
 		td.UnsignedImage = imageToSign
@@ -265,14 +252,6 @@ func (mp *buildSignPodManager) MakeSignResourceTemplate(ctx context.Context, mld
 		return nil, fmt.Errorf("no image to sign given")
 	}
 
-	if signConfig.UnsignedImageRegistryTLS.Insecure {
-		args = append(args, "--insecure-pull")
-	}
-
-	if signConfig.UnsignedImageRegistryTLS.InsecureSkipTLSVerify {
-		args = append(args, "--skip-tls-verify-pull")
-	}
-
 	volumes := []v1.Volume{
 		utils.MakeSecretVolume(signConfig.KeySecret, "key", "key.pem"),
 		utils.MakeSecretVolume(signConfig.CertSecret, "cert", "cert.pem"),
@@ -346,7 +325,7 @@ func (mp *buildSignPodManager) MakeSignResourceTemplate(ctx context.Context, mld
 		Tolerations:   mld.Tolerations,
 	}
 
-	podSpecHash, err := mp.getSignHashAnnotationValue(ctx, signConfig.KeySecret.Name,
+	podSpecHash, err := bspm.getSignHashAnnotationValue(ctx, signConfig.KeySecret.Name,
 		signConfig.CertSecret.Name, mld.Namespace, buf.Bytes(), &podSpec)
 	if err != nil {
 		return nil, fmt.Errorf("could not hash pod's definitions: %v", err)
@@ -356,7 +335,7 @@ func (mp *buildSignPodManager) MakeSignResourceTemplate(ctx context.Context, mld
 		ObjectMeta: metav1.ObjectMeta{
 			GenerateName: mld.Name + "-sign-",
 			Namespace:    mld.Namespace,
-			Labels:       mp.PodLabels(mld.Name, mld.KernelNormalizedVersion, PodTypeSign),
+			Labels:       bspm.PodLabels(mld.Name, mld.KernelNormalizedVersion, PodTypeSign),
 			Annotations: map[string]string{
 				constants.PodHashAnnotation: fmt.Sprintf("%d", podSpecHash),
 				dockerfileAnnotationKey:     buf.String(),
@@ -366,7 +345,7 @@ func (mp *buildSignPodManager) MakeSignResourceTemplate(ctx context.Context, mld
 		Spec: podSpec,
 	}
 
-	if err = controllerutil.SetControllerReference(owner, pod, mp.scheme); err != nil {
+	if err = controllerutil.SetControllerReference(owner, pod, bspm.scheme); err != nil {
 		return nil, fmt.Errorf("could not set the owner reference: %v", err)
 	}
 
diff --git a/internal/buildsign/pod/buildsignpodmanager_test.go b/internal/buildsign/pod/buildsignpodmanager_test.go
index b8182f5a1..a5bc727a2 100644
--- a/internal/buildsign/pod/buildsignpodmanager_test.go
+++ b/internal/buildsign/pod/buildsignpodmanager_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	kmmv1beta1 "github.com/kubernetes-sigs/kernel-module-management/api/v1beta1"
+	"github.com/mitchellh/hashstructure/v2"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	v1 "k8s.io/api/core/v1"
@@ -691,7 +692,14 @@ var _ = Describe("MakeBuildResourceTemplate", func() {
 					},
 				)
 		}
-		hash, err := getBuildHashValue(&expected.Spec, dockerfile)
+		dataToHash := struct {
+			PodSpec    *v1.PodSpec
+			Dockerfile string
+		}{
+			PodSpec:    &expected.Spec,
+			Dockerfile: dockerfile,
+		}
+		hash, err := hashstructure.Hash(dataToHash, hashstructure.FormatV2, nil)
 		Expect(err).NotTo(HaveOccurred())
 		annotations := map[string]string{constants.PodHashAnnotation: fmt.Sprintf("%d", hash)}
 		expected.SetAnnotations(annotations)
@@ -1095,7 +1103,18 @@ COPY --from=signimage /tmp/signroot/modules/simple-procfs-kmod.ko /modules/simpl
 				)
 		}
 
-		hash, err := getSignHashValue(&expected.Spec, []byte(publicKey), []byte(privateKey), []byte(dockerfile))
+		dataToHash := struct {
+			PodSpec        *v1.PodSpec
+			PrivateKeyData []byte
+			PublicKeyData  []byte
+			SignConfig     []byte
+		}{
+			PodSpec:        &expected.Spec,
+			PrivateKeyData: []byte(privateKey),
+			PublicKeyData:  []byte(publicKey),
+			SignConfig:     []byte(dockerfile),
+		}
+		hash, err := hashstructure.Hash(dataToHash, hashstructure.FormatV2, nil)
 		Expect(err).NotTo(HaveOccurred())
 		annotations := map[string]string{
 			constants.PodHashAnnotation: fmt.Sprintf("%d", hash),
@@ -1172,7 +1191,7 @@ COPY --from=signimage /tmp/signroot/modules/simple-procfs-kmod.ko /modules/simpl
 		if pushImage {
 			Expect(actual.Spec.Containers[0].Args).To(ContainElement("--destination"))
 		} else {
-			Expect(actual.Spec.Containers[0].Args).To(ContainElement("-no-push"))
+			Expect(actual.Spec.Containers[0].Args).To(ContainElement("--no-push"))
 		}
 
 	},
diff --git a/internal/buildsign/pod/common.go b/internal/buildsign/pod/common.go
index f597620de..0c7d61694 100644
--- a/internal/buildsign/pod/common.go
+++ b/internal/buildsign/pod/common.go
@@ -32,9 +32,25 @@ var tmpl = template.Must(
 	template.ParseFS(templateFS, "templates/Dockerfile.gotmpl"),
 )
 
-func (pm *buildSignPodManager) podSpec(mld *api.ModuleLoaderData, containerImage string, pushImage bool) v1.PodSpec {
+func (bspm *buildSignPodManager) podSpec(mld *api.ModuleLoaderData, containerImage string, pushImage bool) v1.PodSpec {
 
 	buildConfig := mld.Build
+
+	args := bspm.containerArgs(mld, containerImage, mld.Build.BaseImageRegistryTLS, pushImage)
+	overrides := []kmmv1beta1.BuildArg{
+		{Name: "KERNEL_VERSION", Value: mld.KernelVersion},
+		{Name: "KERNEL_FULL_VERSION", Value: mld.KernelVersion},
+		{Name: "MOD_NAME", Value: mld.Name},
+		{Name: "MOD_NAMESPACE", Value: mld.Namespace},
+	}
+	buildArgs := bspm.combiner.ApplyBuildArgOverrides(
+		buildConfig.BuildArgs,
+		overrides...,
+	)
+	for _, ba := range buildArgs {
+		args = append(args, "--build-arg", fmt.Sprintf("%s=%s", ba.Name, ba.Value))
+	}
+
 	kanikoImage := os.Getenv("RELATED_IMAGE_BUILD")
 
 	if buildConfig.KanikoParams != nil && buildConfig.KanikoParams.Tag != "" {
@@ -53,7 +69,7 @@ func (pm *buildSignPodManager) podSpec(mld *api.ModuleLoaderData, containerImage
 	return v1.PodSpec{
 		Containers: []v1.Container{
 			{
-				Args:         pm.containerArgs(buildConfig, mld, containerImage, pushImage),
+				Args:         args,
 				Name:         "kaniko",
 				Image:        kanikoImage,
 				VolumeMounts: volumeMounts(mld.ImageRepoSecret, buildConfig),
@@ -66,121 +82,108 @@ func (pm *buildSignPodManager) podSpec(mld *api.ModuleLoaderData, containerImage
 	}
 }
 
-func (pm *buildSignPodManager) containerArgs(
-	buildConfig *kmmv1beta1.Build,
-	mld *api.ModuleLoaderData,
-	containerImage string,
-	pushImage bool) []string {
+func (bspm *buildSignPodManager) containerArgs(mld *api.ModuleLoaderData, destinationImg string,
+	tlsOptions kmmv1beta1.TLSOptions, pushImage bool) []string {
 
 	args := []string{}
+
 	if pushImage {
-		args = append(args, "--destination", containerImage)
+		args = append(args, "--destination", destinationImg)
+		if mld.RegistryTLS.Insecure {
+			args = append(args, "--insecure")
+		}
+		if mld.RegistryTLS.InsecureSkipTLSVerify {
+			args = append(args, "--skip-tls-verify")
+		}
 	} else {
 		args = append(args, "--no-push")
 	}
 
-	overrides := []kmmv1beta1.BuildArg{
-		{Name: "KERNEL_VERSION", Value: mld.KernelVersion},
-		{Name: "KERNEL_FULL_VERSION", Value: mld.KernelVersion},
-		{Name: "MOD_NAME", Value: mld.Name},
-		{Name: "MOD_NAMESPACE", Value: mld.Namespace},
-	}
-	buildArgs := pm.combiner.ApplyBuildArgOverrides(
-		buildConfig.BuildArgs,
-		overrides...,
-	)
-
-	for _, ba := range buildArgs {
-		args = append(args, "--build-arg", fmt.Sprintf("%s=%s", ba.Name, ba.Value))
-	}
-
-	if buildConfig.BaseImageRegistryTLS.Insecure {
+	if tlsOptions.Insecure {
 		args = append(args, "--insecure-pull")
 	}
 
-	if buildConfig.BaseImageRegistryTLS.InsecureSkipTLSVerify {
+	if tlsOptions.InsecureSkipTLSVerify {
 		args = append(args, "--skip-tls-verify-pull")
 	}
 
-	if pushImage {
-		if mld.RegistryTLS.Insecure {
-			args = append(args, "--insecure")
-		}
-
-		if mld.RegistryTLS.InsecureSkipTLSVerify {
-			args = append(args, "--skip-tls-verify")
-		}
-	}
-
 	return args
+
 }
 
-// builder
-func (pm *buildSignPodManager) getBuildHashAnnotationValue(ctx context.Context, configMapName, namespace string,
+func (bspm *buildSignPodManager) getBuildHashAnnotationValue(ctx context.Context, configMapName, namespace string,
 	podSpec *v1.PodSpec) (uint64, error) {
 
 	dockerfileCM := &corev1.ConfigMap{}
 	namespacedName := types.NamespacedName{Name: configMapName, Namespace: namespace}
-	if err := pm.client.Get(ctx, namespacedName, dockerfileCM); err != nil {
+	if err := bspm.client.Get(ctx, namespacedName, dockerfileCM); err != nil {
 		return 0, fmt.Errorf("failed to get dockerfile ConfigMap %s: %v", namespacedName, err)
 	}
-	data, ok := dockerfileCM.Data[constants.DockerfileCMKey]
+	dockerfile, ok := dockerfileCM.Data[constants.DockerfileCMKey]
 	if !ok {
 		return 0, fmt.Errorf("invalid Dockerfile ConfigMap %s format, %s key is missing", namespacedName, constants.DockerfileCMKey)
 	}
 
-	return getBuildHashValue(podSpec, data)
+	dataToHash := struct {
+		PodSpec    *v1.PodSpec
+		Dockerfile string
+	}{
+		PodSpec:    podSpec,
+		Dockerfile: dockerfile,
+	}
+	hashValue, err := hashstructure.Hash(dataToHash, hashstructure.FormatV2, nil)
+	if err != nil {
+		return 0, fmt.Errorf("could not hash pod's spec template and dockefile: %v", err)
+	}
+
+	return hashValue, nil
 }
 
-// signer
-func (pm *buildSignPodManager) getSignHashAnnotationValue(ctx context.Context, privateSecret, publicSecret, namespace string,
+func (bspm *buildSignPodManager) getSignHashAnnotationValue(ctx context.Context, privateSecret, publicSecret, namespace string,
 	signConfig []byte, podSpec *v1.PodSpec) (uint64, error) {
 
-	privateKeyData, err := pm.getSecretData(ctx, privateSecret, constants.PrivateSignDataKey, namespace)
+	privateKeyData, err := bspm.getSecretData(ctx, privateSecret, constants.PrivateSignDataKey, namespace)
 	if err != nil {
 		return 0, fmt.Errorf("failed to get private secret %s for signing: %v", privateSecret, err)
 	}
-	publicKeyData, err := pm.getSecretData(ctx, publicSecret, constants.PublicSignDataKey, namespace)
+	publicKeyData, err := bspm.getSecretData(ctx, publicSecret, constants.PublicSignDataKey, namespace)
 	if err != nil {
 		return 0, fmt.Errorf("failed to get public secret %s for signing: %v", publicSecret, err)
 	}
 
-	return getSignHashValue(podSpec, publicKeyData, privateKeyData, signConfig)
-}
-
-func (pm *buildSignPodManager) getSecretData(ctx context.Context, secretName, secretDataKey, namespace string) ([]byte, error) {
-	secret := v1.Secret{}
-	namespacedName := types.NamespacedName{Name: secretName, Namespace: namespace}
-	err := pm.client.Get(ctx, namespacedName, &secret)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get Secret %s: %v", namespacedName, err)
-	}
-	data, ok := secret.Data[secretDataKey]
-	if !ok {
-		return nil, fmt.Errorf("invalid Secret %s format, %s key is missing", namespacedName, secretDataKey)
-	}
-	return data, nil
-}
-
-func getSignHashValue(podSpec *v1.PodSpec, publicKeyData, privateKeyData, signConfig []byte) (uint64, error) {
 	dataToHash := struct {
+		PodSpec        *v1.PodSpec
 		PrivateKeyData []byte
 		PublicKeyData  []byte
 		SignConfig     []byte
-		PodSpec        *v1.PodSpec
 	}{
+		PodSpec:        podSpec,
 		PrivateKeyData: privateKeyData,
 		PublicKeyData:  publicKeyData,
 		SignConfig:     signConfig,
-		PodSpec:        podSpec,
 	}
 	hashValue, err := hashstructure.Hash(dataToHash, hashstructure.FormatV2, nil)
 	if err != nil {
-		return 0, fmt.Errorf("could not hash pod's spec template and dockefile: %v", err)
+		return 0, fmt.Errorf("could not hash pod's spec template and signing keys: %v", err)
 	}
+
 	return hashValue, nil
 }
 
+func (bspm *buildSignPodManager) getSecretData(ctx context.Context, secretName, secretDataKey, namespace string) ([]byte, error) {
+	secret := v1.Secret{}
+	namespacedName := types.NamespacedName{Name: secretName, Namespace: namespace}
+	err := bspm.client.Get(ctx, namespacedName, &secret)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get Secret %s: %v", namespacedName, err)
+	}
+	data, ok := secret.Data[secretDataKey]
+	if !ok {
+		return nil, fmt.Errorf("invalid Secret %s format, %s key is missing", namespacedName, secretDataKey)
+	}
+	return data, nil
+}
+
 func volumes(imageRepoSecret *v1.LocalObjectReference, buildConfig *kmmv1beta1.Build) []v1.Volume {
 	volumes := []v1.Volume{dockerfileVolume(dockerfileVolumeName, buildConfig.DockerfileConfigMap)}
 	if imageRepoSecret != nil {
@@ -224,21 +227,6 @@ func dockerfileVolumeMount(name string) v1.VolumeMount {
 	}
 }
 
-func getBuildHashValue(podSpec *v1.PodSpec, dockerfile string) (uint64, error) {
-	dataToHash := struct {
-		Dockerfile string
-		PodSpec    *v1.PodSpec
-	}{
-		Dockerfile: dockerfile,
-		PodSpec:    podSpec,
-	}
-	hashValue, err := hashstructure.Hash(dataToHash, hashstructure.FormatV2, nil)
-	if err != nil {
-		return 0, fmt.Errorf("could not hash pod's spec template and dockefile: %v", err)
-	}
-	return hashValue, nil
-}
-
 func makeImagePullSecretVolume(secretRef *v1.LocalObjectReference) v1.Volume {
 	if secretRef == nil {
 		return v1.Volume{}


Reviews:
user: login: yevgeny-shnaidman
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T08:23:39Z
user: login: ybettan
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T09:05:07Z

Review comments:
diff_hunk: @@ -35,6 +35,22 @@ var tmpl = template.Must(
 func (pm *buildSignPodManager) podSpec(mld *api.ModuleLoaderData, containerImage string, pushImage bool) v1.PodSpec {
path: internal/buildsign/pod/common.go
user: login: yevgeny-shnaidman
body: we have "pm" here, and "mp" in buildsignpodmanager, which is very confusing. Lets reach the common name, it would be better to call it bspm
created_at: 2025-04-10T08:23:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -35,6 +35,22 @@ var tmpl = template.Must(
 func (pm *buildSignPodManager) podSpec(mld *api.ModuleLoaderData, containerImage string, pushImage bool) v1.PodSpec {
path: internal/buildsign/pod/common.go
user: login: ybettan
body: Fixed.
created_at: 2025-04-10T09:05:06Z
author_association: CONTRIBUTOR

PR comments:
user: login: k8s-ci-robot
created_at: 2025-04-10T07:43:32Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/kernel-module-management/pull/1078#" title="Author self-approved">ybettan</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fkernel-module-management).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/kernel-module-management/blob/main/OWNERS)~~ [ybettan]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: CONTRIBUTOR
user: login: netlify[bot]
created_at: 2025-04-10T07:43:43Z
body: ### <span aria-hidden="true">✅</span> Deploy Preview for *kubernetes-sigs-kmm* ready!


|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 0baffbdd174d5ba14fcc93c006a30ec8d007072c |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/kubernetes-sigs-kmm/deploys/67f789b5be76d3000707cb32 |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-1078--kubernetes-sigs-kmm.netlify.app](https://deploy-preview-1078--kubernetes-sigs-kmm.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br />![QR Code](https://app.netlify.com/qr-code/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczovL2RlcGxveS1wcmV2aWV3LTEwNzgtLWt1YmVybmV0ZXMtc2lncy1rbW0ubmV0bGlmeS5hcHAifQ.F-TCfXk7mqrP7leC-RTao-C2anDMAE-VDQ0s16GwRiM)<br /><br />_Use your smartphone camera to open QR code link._</details> |
---
<!-- [kubernetes-sigs-kmm Preview](https://deploy-preview-1078--kubernetes-sigs-kmm.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify site configuration](https://app.netlify.com/sites/kubernetes-sigs-kmm/configuration/notifications#deploy-webhooks)._
author_association: NONE
user: login: codecov-commenter
created_at: 2025-04-10T07:44:41Z
body: ## [Codecov](https://app.codecov.io/gh/kubernetes-sigs/kernel-module-management/pull/1078?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) Report
:x: Patch coverage is `83.75000%` with `13 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 74.67%. Comparing base ([`fa23a9b`](https://app.codecov.io/gh/kubernetes-sigs/kernel-module-management/commit/fa23a9bea255d0cb4f71e727dc37862175f20bba?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs)) to head ([`0baffbd`](https://app.codecov.io/gh/kubernetes-sigs/kernel-module-management/commit/0baffbdd174d5ba14fcc93c006a30ec8d007072c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs)).
:warning: Report is 364 commits behind head on main.

| [Files with missing lines](https://app.codecov.io/gh/kubernetes-sigs/kernel-module-management/pull/1078?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) | Patch % | Lines |
|---|---|---|
| [internal/buildsign/pod/common.go](https://app.codecov.io/gh/kubernetes-sigs/kernel-module-management/pull/1078?src=pr&el=tree&filepath=internal%2Fbuildsign%2Fpod%2Fcommon.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs#diff-aW50ZXJuYWwvYnVpbGRzaWduL3BvZC9jb21tb24uZ28=) | 81.35% | [7 Missing and 4 partials :warning: ](https://app.codecov.io/gh/kubernetes-sigs/kernel-module-management/pull/1078?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) |
| [internal/buildsign/pod/buildsignpodmanager.go](https://app.codecov.io/gh/kubernetes-sigs/kernel-module-management/pull/1078?src=pr&el=tree&filepath=internal%2Fbuildsign%2Fpod%2Fbuildsignpodmanager.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs#diff-aW50ZXJuYWwvYnVpbGRzaWduL3BvZC9idWlsZHNpZ25wb2RtYW5hZ2VyLmdv) | 90.47% | [0 Missing and 2 partials :warning: ](https://app.codecov.io/gh/kubernetes-sigs/kernel-module-management/pull/1078?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) |

<details><summary>Additional details and impacted files</summary>



```diff
@@            Coverage Diff             @@
##             main    #1078      +/-   ##
==========================================
- Coverage   79.09%   74.67%   -4.43%     
==========================================
  Files          51       76      +25     
  Lines        5109     6847    +1738     
==========================================
+ Hits         4041     5113    +1072     
- Misses        882     1523     +641     
- Partials      186      211      +25     
```
</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/kubernetes-sigs/kernel-module-management/pull/1078?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs).
<details><summary> :rocket: New features to boost your workflow: </summary>

- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
author_association: NONE
user: login: ybettan
created_at: 2025-04-10T07:49:49Z
body: /override pull-kernel-module-management-check-commits-count

This is a multi-commit PR.
author_association: CONTRIBUTOR
user: login: k8s-ci-robot
created_at: 2025-04-10T07:49:52Z
body: @ybettan: Overrode contexts on behalf of ybettan: pull-kernel-module-management-check-commits-count

<details>

In response to [this](https://github.com/kubernetes-sigs/kernel-module-management/pull/1078#issuecomment-2791865316):

>/override pull-kernel-module-management-check-commits-count
>
>This is a multi-commit PR.


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: CONTRIBUTOR
user: login: yevgeny-shnaidman
created_at: 2025-04-10T08:21:49Z
body: why do we need 2 commits in this PR? They are unrelated.

author_association: CONTRIBUTOR
user: login: ybettan
created_at: 2025-04-10T08:59:46Z
body: > why do we need 2 commits in this PR? They are unrelated.

Because it feels like having ~10 PRs to refactor a single file (cause it easier to refactor function by function) will bring a lot of overhead. So I am trying to group them as much as possible cause they all fit in the "refactor the buildsign package for code re-usage" change. I think the important part are the commits since they are the one with "git blame" eventually.
author_association: CONTRIBUTOR
user: login: yevgeny-shnaidman
created_at: 2025-04-10T09:16:03Z
body: /lgtm
author_association: CONTRIBUTOR
user: login: ybettan
created_at: 2025-04-10T09:17:42Z
body: /override pull-kernel-module-management-check-commits-count

This is a multi-commit PR.
author_association: CONTRIBUTOR
user: login: k8s-ci-robot
created_at: 2025-04-10T09:17:45Z
body: @ybettan: Overrode contexts on behalf of ybettan: pull-kernel-module-management-check-commits-count

<details>

In response to [this](https://github.com/kubernetes-sigs/kernel-module-management/pull/1078#issuecomment-2792104690):

>/override pull-kernel-module-management-check-commits-count
>
>This is a multi-commit PR.


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: CONTRIBUTOR