fix: register current admission webhook subresources - #4785
Open
JaydipGabani wants to merge 3 commits into
Open
Conversation
Register known non-status subresources for both admission webhooks so exact-match rules handle namespace finalization, token requests, CSR approvals, pod resize, and the existing supported subresources consistently. Regenerate webhook manifests and Helm chart staging outputs while continuing to exclude status subresources except services/status. Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Registers current non-status Kubernetes subresources with both admission webhooks while retaining services/status.
Changes:
- Adds namespace finalization, token creation, CSR approval, and pod resize coverage.
- Synchronizes generated manifests and Helm defaults.
- Applies incidental Go formatting fixes.
Reviewed changes
Copilot reviewed 10 out of 12 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
pkg/webhook/policy.go |
Extends validating webhook rules. |
pkg/webhook/mutation.go |
Extends mutating webhook rules. |
pkg/mutation/system_external_data.go |
Formatting only. |
pkg/controller/externaldata/stats_reporter.go |
Formatting only. |
config/webhook/manifests.yaml |
Updates generated webhook configurations. |
manifest_staging/deploy/gatekeeper.yaml |
Updates staged deployment manifest. |
manifest_staging/charts/gatekeeper/values.yaml |
Updates staged Helm defaults. |
manifest_staging/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml |
Updates discovery guidance. |
manifest_staging/charts/gatekeeper/README.md |
Documents staged defaults. |
cmd/build/helmify/static/values.yaml |
Updates Helm source defaults. |
cmd/build/helmify/static/README.md |
Documents source defaults. |
cmd/build/helmify/replacements.go |
Updates generated template guidance. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests.
Additional details and impacted files@@ Coverage Diff @@
## master #4785 +/- ##
==========================================
- Coverage 54.49% 47.85% -6.65%
==========================================
Files 134 290 +156
Lines 12329 22908 +10579
==========================================
+ Hits 6719 10963 +4244
- Misses 5116 10984 +5868
- Partials 494 961 +467
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Registers the current known non-status subresources for both admission webhooks so requests such as namespace finalization, service account token creation, certificate signing request approval, and pod resize are sent to Gatekeeper with
matchPolicy: Exact. This keeps the generated manifests and Helm defaults consistent while preservingservices/statusas the only explicit status-subresource exception.Which issue(s) this PR fixes:
N/A
Special notes for your reviewer:
The two external-data Go hunks are formatting-only.
Validation:
make manifestsmake lintGOTOOLCHAIN=go1.26.0 GOCACHE=/tmp/gatekeeper-webhook-subresources-gocache make native-test LOCALBIN=/tmp/gatekeeper-webhook-subresources-bin