fix: reject multiple mounts with root path for datasets

	Signed-off-by: Priya Sharma <priyasharma1001a@gmail.com>

Signed-off-by: Priya Sharma <priyasharma1001a@gmail.com>

Author: Priya-Sharma25

pkg/controllers/v1alpha1/dataset/dataset_controller.go

@@ -17,6 +17,7 @@ package dataset
 import (
 	"context"
 	"errors"
+	"fmt"
 	"reflect"
 	"strings"
 	"time"
@@ -137,11 +138,42 @@ func (r *DatasetReconciler) reconcileDataset(ctx reconcileRequestContext, needRe
 		return r.reconcileDatasetDeletion(ctx)
 	}
 
-	// 2.Add finalizer
+	// 2. Add finalizer
 	if !utils.ContainsString(ctx.Dataset.ObjectMeta.GetFinalizers(), finalizer) {
 		return r.addFinalizerAndRequeue(ctx)
 	}
 
+	// 2.5 Validate multiple mounts with root path.
+	// This check must come after deletion handling (step 1) so that a Dataset
+	// edited into an invalid state can still be deleted and have its finalizer removed.
+	if len(ctx.Dataset.Spec.Mounts) > 1 {
+		for _, mount := range ctx.Dataset.Spec.Mounts {
+			// Resolve the effective mount path: if mount.Path is explicitly "/", or
+			// if both mount.Path and mount.Name are empty (which defaults to "/"),
+			// the mount targets the root of the unified namespace.
+			effectivePath := mount.Path
+			if effectivePath == "" {
+				effectivePath = fmt.Sprintf(common.UFSMountPathFormat, strings.TrimLeft(mount.Name, "/"))
+			}
+			if effectivePath == common.RootDirPath {
+				err := errors.New("root-path mounting is only supported for single-mount Datasets")
+				ctx.Log.Error(err, "Failed to validate dataset", "DatasetValidationError", ctx)
+				r.Recorder.Eventf(&ctx.Dataset, v1.EventTypeWarning, common.ErrorProcessDatasetReason, "Failed to validate dataset because err: %v", err)
+
+				if ctx.Dataset.Status.Phase == datav1alpha1.FailedDatasetPhase {
+					return utils.NoRequeue()
+				}
+				dataset := ctx.Dataset.DeepCopy()
+				dataset.Status.Phase = datav1alpha1.FailedDatasetPhase
+				if updateErr := r.Status().Update(ctx, dataset); updateErr != nil {
+					ctx.Log.Error(updateErr, "Failed to update the dataset phase to Failed", "StatusUpdateError", ctx)
+					return utils.RequeueIfError(updateErr)
+				}
+				return utils.NoRequeue()
+			}
+		}
+	}
+
 	// 3. Create Runtime if it's reference dataset
 	checkReferenceDataset, err := base.CheckReferenceDataset(&ctx.Dataset)
 	if err != nil {

pkg/controllers/v1alpha1/dataset/dataset_reconciler_test.go

@@ -277,6 +277,93 @@ var _ = Describe("DatasetReconciler (fake client)", func() {
 			Expect(err).To(HaveOccurred())
 			Expect(result).To(Equal(ctrl.Result{}))
 		})
+
+		It("sets FailedDatasetPhase and stops requeue when dataset has multiple mounts and one has root path", func() {
+			ds := datav1alpha1.Dataset{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "multi-root",
+					Namespace:  "default",
+					Finalizers: []string{finalizer},
+				},
+				Spec: datav1alpha1.DatasetSpec{
+					Mounts: []datav1alpha1.Mount{
+						{Name: "m1", MountPoint: "local:///path1", Path: "/"},
+						{Name: "m2", MountPoint: "local:///path2", Path: "/path2"},
+					},
+				},
+				Status: datav1alpha1.DatasetStatus{Phase: datav1alpha1.NotBoundDatasetPhase},
+			}
+			r := newTestReconciler(&ds)
+			ctx := makeReconcileCtx(r, ds)
+
+			result, err := r.reconcileDataset(ctx, false)
+			// NoRequeue: no error, empty result
+			Expect(err).NotTo(HaveOccurred())
+			Expect(result).To(Equal(ctrl.Result{}))
+
+			// Verify status phase is set to FailedDatasetPhase
+			stored := &datav1alpha1.Dataset{}
+			Expect(r.Get(ctx, types.NamespacedName{Namespace: "default", Name: "multi-root"}, stored)).To(Succeed())
+			Expect(stored.Status.Phase).To(Equal(datav1alpha1.FailedDatasetPhase))
+		})
+
+		It("catches implicit root path when mount.Path and mount.Name are both empty", func() {
+			ds := datav1alpha1.Dataset{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "implicit-root",
+					Namespace:  "default",
+					Finalizers: []string{finalizer},
+				},
+				Spec: datav1alpha1.DatasetSpec{
+					Mounts: []datav1alpha1.Mount{
+						{MountPoint: "local:///path1"},
+						{Name: "m2", MountPoint: "local:///path2", Path: "/path2"},
+					},
+				},
+				Status: datav1alpha1.DatasetStatus{Phase: datav1alpha1.NotBoundDatasetPhase},
+			}
+			r := newTestReconciler(&ds)
+			ctx := makeReconcileCtx(r, ds)
+
+			result, err := r.reconcileDataset(ctx, false)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(result).To(Equal(ctrl.Result{}))
+
+			stored := &datav1alpha1.Dataset{}
+			Expect(r.Get(ctx, types.NamespacedName{Namespace: "default", Name: "implicit-root"}, stored)).To(Succeed())
+			Expect(stored.Status.Phase).To(Equal(datav1alpha1.FailedDatasetPhase))
+		})
+
+		It("allows deletion of a dataset that was edited into an invalid multi-mount config", func() {
+			now := metav1.Now()
+			ds := datav1alpha1.Dataset{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:              "del-invalid",
+					Namespace:         "default",
+					Finalizers:        []string{finalizer},
+					DeletionTimestamp: &now,
+				},
+				Spec: datav1alpha1.DatasetSpec{
+					Mounts: []datav1alpha1.Mount{
+						{Name: "m1", MountPoint: "local:///path1", Path: "/"},
+						{Name: "m2", MountPoint: "local:///path2", Path: "/path2"},
+					},
+				},
+			}
+			r := newTestReconciler(&ds)
+			ctx := makeReconcileCtx(r, ds)
+
+			result, err := r.reconcileDataset(ctx, false)
+			// Should proceed to deletion, not block on validation
+			Expect(err).NotTo(HaveOccurred())
+			Expect(result).To(Equal(ctrl.Result{}))
+
+			// Assert the finalizer is removed, demonstrating that the Terminating-stuck regression is fixed.
+			// Once the finalizer is removed on an object with a deletion timestamp, the API server (or mock client) deletes it.
+			stored := &datav1alpha1.Dataset{}
+			getErr := r.Get(ctx, types.NamespacedName{Namespace: "default", Name: "del-invalid"}, stored)
+			Expect(apierrors.IsNotFound(getErr)).To(BeTrue())
+		})
 	})
 
 	Describe("reconcileDatasetDeletion", func() {