✨ Add NamespaceSelector to generated webhook configs #2076
Conversation
Signed-off-by: Per Goncalves da Silva <[email protected]>
✅ Deploy Preview for olmv1 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #2076 +/- ##
==========================================
+ Coverage 73.34% 73.37% +0.03%
==========================================
Files 77 77
Lines 7056 7076 +20
==========================================
+ Hits 5175 5192 +17
- Misses 1541 1543 +2
- Partials 340 341 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| @@ -29,6 +30,8 @@ import ( | |||
| const ( | |||
| tlsCrtPath = "tls.crt" | |||
| tlsKeyPath = "tls.key" | |||
|
|
|||
| labelKubernetesNamespaceMetadataName = "kubernetes.io/metadata.name" | |||
There was a problem hiding this comment.
Is this right? Should it be metadata.namespace? Because this ought to be the name of the resource, not the namespace?
There was a problem hiding this comment.
(Unless you're looking at namespaces?)
Description
Sets the NamespaceSelector in generated Validating and MutatingWebhookConfiguration resources. This ensures that webhooks for operators installed in single/own namespace mode are (at least for namespaced APIs) restricted to the target namespace of the installation.
The implementation diverges from that of OLMv0. In OLM v0 the namespace selector is derived from OperatorGroup labels OLM sets on the target namespaces. In OLMv1 we don't have OperatorGroups and there's probably no need to add any labels to target namespaces. So, we use the kubernetes provided "kubernetes.io/metadata.name" label. This may not work in older versions of kubernetes.
Note: the renderer itself supports rendering the bundle manifests for multi-namespace mode. OLMv1 just doesn't support MultiNamespace mode. Therefore, the namespace selector uses a match expression with the
Inoperator.Reviewer Checklist