fix: handle multi-architecture images in registry lookup

The webhook was failing when trying to inspect images that only had arm64
variants available, as it defaulted to looking up amd64 images first. This
was problematic because the webhook runs before pod scheduling, so we don't
yet know which architecture the pod will run on.

The fix modifies the image lookup logic to take the first available image
manifest from the registry's manifest list, regardless of architecture.
This works because the core image configuration (entrypoint, env vars, etc.)
that we need to inspect is typically identical across architectures.

Signed-off-by: Nils Mueller <20240901+Tolsto@users.noreply.github.com>

pkg/webhook/registry.go

@@ -197,9 +197,32 @@ func getImageConfig(ctx context.Context, client kubernetes.Interface, container
 		return nil, errors.Wrap(err, "cannot fetch image descriptor")
 	}
 
-	image, err := descriptor.Image()
-	if err != nil {
-		return nil, errors.Wrap(err, "cannot convert image descriptor to v1.Image")
+	var image v1.Image
+	if descriptor.MediaType.IsIndex() {
+		index, err := descriptor.ImageIndex()
+		if err != nil {
+			return nil, errors.Wrap(err, "cannot get image index")
+		}
+
+		manifest, err := index.IndexManifest()
+		if err != nil {
+			return nil, errors.Wrap(err, "cannot get index manifest")
+		}
+
+		if len(manifest.Manifests) == 0 {
+			return nil, errors.New("no manifests found in the image index")
+		}
+
+		// Get the first available image
+		image, err = index.Image(manifest.Manifests[0].Digest)
+		if err != nil {
+			return nil, errors.Wrap(err, "cannot get image from manifest")
+		}
+	} else {
+		image, err = descriptor.Image()
+		if err != nil {
+			return nil, errors.Wrap(err, "cannot convert image descriptor to v1.Image")
+		}
 	}
 
 	configFile, err := image.ConfigFile()