Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make namespaceSelector and scope for the MutatingWebhookConfiguration user-configurable #562

Closed
tkent opened this issue Sep 14, 2022 · 2 comments
Labels
enhancement New feature or request helm

Comments

@tkent
Copy link

tkent commented Sep 14, 2022

Is your feature request related to a problem? Please describe.

Currently the helm chart allows the objectSelector of the MutatingWebhookConfiguration to be user specified. This is very useful to ensure that the cluster continues to operate correctly when failurePolicy=Fail and azure-workload-identity pods are not running. As long as you ensure certain labels are only set on the pods that require azure-workload-identity and you define the selector, you're good to go.

However, there are two additional useful configurations, namespaceSelector and scope, which allow you exclude namespaces from evaluation. This is useful when it comes to the kube-system namespace and for pods where you can't easily control their labels.

It would be great if these were also user configurable.

Describe alternatives you've considered

We can ensure all pods that rely on the admission controller have labels that match an objectSelector of our choosing. While this works, it doesn't guarantee the AC won't be applied to pods in a namespace where we don't want it, like kube-system.

Additional context

In #516, I asked to make the failurePolicy of the MutatingWebhookConfiguration configurable (thanks for doing that, btw).

However, I failed to ask to make this request at the same time. I haven't actually run into a problem yet, but I'd like to never have it come up.

@tkent tkent added the enhancement New feature or request label Sep 14, 2022
@salaxander salaxander added this to the v0.15.0 milestone Oct 18, 2022
@Tolsto
Copy link

Tolsto commented Oct 21, 2022

Making sure that the webhook pod itself is always excluded in the MutatingWebhookConfiguration would be a sensible default for the Helm chart.
I had the issue today that no new pods would get scheduled because failurePolicy=Fail was set and there were no running wi-webhook pods running, resulting in a catch-22.

@enj
Copy link
Member

enj commented Nov 22, 2022

#601 should help in these cases as well.

@aramase aramase modified the milestones: v0.15.0, v1.0.0-alpha.1 Jan 6, 2023
@salaxander salaxander moved this from Backlog to Done in Roadmap Jan 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request helm
Projects
Status: Done
Development

No branches or pull requests

5 participants