fix(fluentd): propagate sidecarContainers to the configcheck pod

Motivation:
FluentdSpec.SidecarContainers is added to the Fluentd StatefulSet pod
but was never propagated to the transient fluentd-configcheck-* pod
that dry-runs the rendered config before rollout. Users who need a
sidecar to run before the aggregator starts (e.g. to refresh a
GeoIP database via extraVolumes, as reported) only got it on the
StatefulSet, not on the config check.

Approach:
Mirror the existing statefulset.go pattern in containerCheckPod
(pkg/resources/fluentd/appconfigmap.go): append
fluentdSpec.SidecarContainers to the check pod's container list when
non-empty. The fluentd container that other code paths index at
Containers[0] (e.g. the TLS volume mount) is unaffected since
sidecars are appended after it.

Validation:
- go build ./... and go vet ./pkg/resources/fluentd/... pass.
- Added TestNewCheckPodSidecarContainers to appconfigmap_test.go,
  which asserts the configcheck pod's container list contains a
  configured sidecar. Confirmed it fails without the fix (stashing
  only appconfigmap.go reproduces the reported bug) and passes with
  it: go test ./pkg/resources/fluentd/... -run TestNewCheckPod -v
- make lint reports 0 issues across all three modules.
- make test passes across the full suite with no failures.
- make license-check fails, but identically on unmodified master
  (verified via git stash), so it is a pre-existing environment
  issue unrelated to this change.

User-visible behaviour of the main Fluentd StatefulSet is unchanged;
this only fixes the config check pod, whose config validation
previously ran without any configured sidecars.

Report: #2103
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

Author: pujitha24

pkg/resources/fluentd/appconfigmap.go

@@ -430,6 +430,10 @@ func (r *Reconciler) containerCheckPod(fluentdSpec v1beta1.FluentdSpec) []corev1
 		},
 	}
 
+	if len(fluentdSpec.SidecarContainers) != 0 {
+		container = append(container, fluentdSpec.SidecarContainers...)
+	}
+
 	return container
 }
 

pkg/resources/fluentd/appconfigmap_test.go

@@ -122,3 +122,23 @@ func TestNewCheckPodDNSSettingsMatchStatefulSet(t *testing.T) {
 	assert.Equal(t, sts.Spec.Template.Spec.DNSPolicy, checkPod.Spec.DNSPolicy)
 	assert.Equal(t, sts.Spec.Template.Spec.DNSConfig, checkPod.Spec.DNSConfig)
 }
+
+// TestNewCheckPodSidecarContainers pins the configcheck pod to carry the same
+// sidecarContainers as the aggregator StatefulSet, since a sidecar that only
+// mutates shared config (e.g. refreshing a GeoIP database via extraVolumes)
+// needs to run before the check as well, or the check validates against stale
+// input.
+func TestNewCheckPodSidecarContainers(t *testing.T) {
+	sidecar := corev1.Container{
+		Name:  "fluentd-sidecar",
+		Image: "busybox:1.37",
+	}
+	spec := &v1beta1.FluentdSpec{
+		SidecarContainers: []corev1.Container{sidecar},
+	}
+	r := newCheckPodReconciler(t, spec)
+
+	checkPod := r.newCheckPod("deadbeef", *r.fluentdSpec)
+
+	assert.Contains(t, checkPod.Spec.Containers, sidecar)
+}