✨ Add NamespaceSelector to generated webhook configs #2076
Conversation
Signed-off-by: Per Goncalves da Silva <[email protected]>
✅ Deploy Preview for olmv1 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #2076 +/- ##
==========================================
+ Coverage 73.34% 73.37% +0.03%
==========================================
Files 77 77
Lines 7056 7076 +20
==========================================
+ Hits 5175 5192 +17
- Misses 1541 1543 +2
- Partials 340 341 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| @@ -29,6 +30,8 @@ import ( | |||
| const ( | |||
| tlsCrtPath = "tls.crt" | |||
| tlsKeyPath = "tls.key" | |||
|
|
|||
| labelKubernetesNamespaceMetadataName = "kubernetes.io/metadata.name" | |||
There was a problem hiding this comment.
Is this right? Should it be metadata.namespace? Because this ought to be the name of the resource, not the namespace?
There was a problem hiding this comment.
(Unless you're looking at namespaces?)
There was a problem hiding this comment.
I think so. We're selecting for the name of namespace. In more recent kube versions, the label "kubernetes.io/metadata.name" started to be stamped out to allow for label selection on the resource name. So, if targetNamespaces = ["ns1"], it will limit the webhook to namespaces with label "kubernetes.io/metadata.name" in ["ns1"] => the namespace with name ns1. Or, am I misunderstanding your question?
There was a problem hiding this comment.
I think i may have been confused, but you're looking at namespace resources for this selector, so I think we're good.
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: tmshort The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
openshift-merge-bot
bot
merged commit d101484
into
operator-framework:main
Description
Sets the NamespaceSelector in generated Validating and MutatingWebhookConfiguration resources. This ensures that webhooks for operators installed in single/own namespace mode are (at least for namespaced APIs) restricted to the target namespace of the installation.
The implementation diverges from that of OLMv0. In OLM v0 the namespace selector is derived from OperatorGroup labels OLM sets on the target namespaces. In OLMv1 we don't have OperatorGroups and there's probably no need to add any labels to target namespaces. So, we use the kubernetes provided "kubernetes.io/metadata.name" label. This may not work in older versions of kubernetes.
Note: the renderer itself supports rendering the bundle manifests for multi-namespace mode. OLMv1 just doesn't support MultiNamespace mode. Therefore, the namespace selector uses a match expression with the
Inoperator.Reviewer Checklist