Unable to get owner of resource object does not deploy sidecar to deployable Kind specified

[spstarr]

Expected Behavior

Operator attaches sidecar to deployable Kind in namespace.

Actual Behavior

2023-03-02T20:14:20Z    INFO    could not get owner     {"owner": "&OwnerReference{Kind:MyCustomResource,Name:custom-resource-thing,UID:66dea891-a7c7-482c-9346-a73822381ede,APIVersion:my.example.com/v1alpha1,Controller:*true,BlockOwnerDeletion:nil,}", "err": "Timeout: failed waiting for *v1.PartialObjectMetadata Informer to sync"}
2023-03-02T20:14:20Z    DEBUG   controller-runtime.webhook.webhooks     wrote response  {"webhook": "/mutate-pods", "code": 500, "reason": "", "UID": "be75e6a4-7d54-4d93-ad3f-6e38a72f807a", "allowed": false}

Steps to Reproduce the Problem

Using this AuthProxyWorkload CR, I am using Config Connector but that shouldn't matter here:

{{- range $.Values.cloudSQLInstances }}
apiVersion: cloudsql.cloud.google.com/v1alpha1
kind: AuthProxyWorkload
metadata:
  name: {{ template "my-operator.fullname" $ }}
  namespace: mynamespace
  annotations:
    cnrm.cloud.google.com/project-id: {{ $.Values.projectId }}
    cnrm.cloud.google.com/deletion-policy: abandon
  labels:
    {{- include "my-operator.labels" $ | nindent 4 }}
spec:
  workloadSelector:
    kind: "StatefulSet"
    name: "my-deployment"
  instances:
  - connectionString: "{{ $.Values.projectId }}:{{ $.Values.region }}:{{ .instance }}"
    port: 5432
    privateIP: true
{{- end }}

Specifications

023-03-02T19:47:57Z    INFO    Starting Cloud SQL Proxy Operator
2023-03-02T19:47:57Z    INFO    Version: 0.3.0 Build: 53b97905ee71b2902fcff985a7a5d414164e7323
2023-03-02T19:47:57Z    INFO    Runtime: go1.20.1 linux/amd64

[hessjcg]

Thanks @spstarr!

It appears that the pod admission webhook is failing improperly while looking for the parents of a pod. This can happen when owner of a pod is a Custom Resources. The operator may not have the permissions to read that custom resource.

I'll update the implementation of the webhook so that it looks only for parents that are one of the workloads it is allowed to access: Pod, Deployment, ReplicaSet, DaemonSet, StatefulSet, Job, CronJob

[spstarr]

Makes sense, yes, I am using a custom resource here, it spins up StatefulSets