Don't inject namespaceSelector for namespace and project validating…

… webhooks. This lead to the agent not receiving new namepaces.
appuio · Aug 28, 2024 · 96c2c30 · 96c2c30
1 parent 612c10c
commit 96c2c30
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 25 deletions.
diff --git a/component/agent.jsonnet b/component/agent.jsonnet
@@ -197,7 +197,19 @@ local admissionWebhook = std.map(function(webhook) webhook {
           namespace: params.namespace,
         },
       },
-      namespaceSelector: params.agent.webhook.namespaceSelector,
+      // Inject namespace selector for objects that are not namespaces or projects
+      [if !(
+        std.length(
+          std.filter(
+            function(r) std.length(
+              std.setInter(
+                std.set([ 'projects', 'projectrequests', 'namespaces' ]),
+                std.set(r.resources),
+              )
+            ) > 0, w.rules
+          )
+        ) > 0
+      ) then 'namespaceSelector']: params.agent.webhook.namespaceSelector,
     }
     for w in super.webhooks
   ],

diff --git a/tests/golden/defaults/appuio-cloud/appuio-cloud/01_agent/10_webhook_config.yaml b/tests/golden/defaults/appuio-cloud/appuio-cloud/01_agent/10_webhook_config.yaml
@@ -40,10 +40,6 @@ webhooks:
     failurePolicy: Fail
     matchPolicy: Equivalent
     name: namespace.namespace-project-organization-mutator.appuio.io
-    namespaceSelector:
-      matchExpressions:
-        - key: appuio.io/organization
-          operator: Exists
     rules:
       - apiGroups:
           - ''
@@ -66,10 +62,6 @@ webhooks:
     failurePolicy: Fail
     matchPolicy: Equivalent
     name: project.namespace-project-organization-mutator.appuio.io
-    namespaceSelector:
-      matchExpressions:
-        - key: appuio.io/organization
-          operator: Exists
     rules:
       - apiGroups:
           - project.openshift.io
@@ -98,10 +90,6 @@ webhooks:
     failurePolicy: Fail
     matchPolicy: Equivalent
     name: validate-namespace-metadata-projectrequests.appuio.io
-    namespaceSelector:
-      matchExpressions:
-        - key: appuio.io/organization
-          operator: Exists
     rules:
       - apiGroups:
           - project.openshift.io
@@ -124,10 +112,6 @@ webhooks:
     failurePolicy: Fail
     matchPolicy: Equivalent
     name: validate-namespace-metadata.appuio.io
-    namespaceSelector:
-      matchExpressions:
-        - key: appuio.io/organization
-          operator: Exists
     rules:
       - apiGroups:
           - ''
@@ -150,10 +134,6 @@ webhooks:
     failurePolicy: Fail
     matchPolicy: Equivalent
     name: validate-namespace-quota-projectrequests.appuio.io
-    namespaceSelector:
-      matchExpressions:
-        - key: appuio.io/organization
-          operator: Exists
     rules:
       - apiGroups:
           - project.openshift.io
@@ -175,10 +155,6 @@ webhooks:
     failurePolicy: Fail
     matchPolicy: Equivalent
     name: validate-namespace-quota.appuio.io
-    namespaceSelector:
-      matchExpressions:
-        - key: appuio.io/organization
-          operator: Exists
     rules:
       - apiGroups:
           - ''