[SAURABHSALVE]

What this PR does / why we need it:

ContainerPatch.__post_init__ validates each env entry but only checks that at least one of value/valueFrom is present. It never rejects an entry that sets both, even though the Kubernetes API treats them as mutually exclusive: EnvVar.valueFrom's own description is "Cannot be used if value is not empty." Such a patch currently passes SDK validation and only fails later, server-side, when the TrainJob is actually created.

This adds a check that rejects an env entry when value is a non-empty string and valueFrom is also set, matching Kubernetes' own rule. An empty-string value alongside valueFrom is still accepted, since the Kubernetes API only disallows the combination when value is not empty.

from kubeflow.trainer.options.kubernetes import ContainerPatch

ContainerPatch(
    name="main",
    env=[{
        "name": "LOG_LEVEL",
        "value": "debug",
        "valueFrom": {"fieldRef": {"fieldPath": "metadata.name"}},
    }],
)
# Before: no error -- accepted, then rejected server-side at TrainJob creation.
# After:  ValueError: env 'value' and 'valueFrom' are mutually exclusive

Tests:

• Added a case to the existing test_container_patch_validation parametrize for the new rejection.
• Added test_container_patch_accepts_valid_env_entries covering value only, valueFrom only, and an empty-string value with valueFrom, to confirm previously-valid inputs still pass.

Which issue(s) this PR fixes:

Fixes #883

Checklist:

• Docs included if any changes are user facing

🤖 Generated with Claude Code

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andreyvelich for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment