[vault-secrets-webhook] Kubernetes version misinterpreted on Helm chart

[martinezleoml]

Describe the bug:
When deploying vault-secrets-webhook on AWS managed Kubernetes cluster (EKS) using Helm, the webhook is self-mutated despite of security.banzaicloud.io/mutate annotation on its pods.

We figured out that the MutatingWebhookConfiguration deployed in this cluster was missing the objectSelector directive whereas the cluster is running on v1.16.

$ kubectl version --short
Client Version: v1.18.2
Server Version: v1.16.8-eks-e16311

This is caused by Helm reporting .Capabilities.KubeVersion.Minor value of 16+ instead of 16. This value becomes 0 when casted to an integer:

{{- if and (eq (int $major) 1) (ge (int $minor) 15) }}
  objectSelector:
[...]
{{- end }}

Expected behaviour:
The objectSelector directive should be present on MutatingWebhookConfiguration for Kubernetes clusters running version >= v1.15.

Steps to reproduce the bug:

1. Deploy a Kubernetes cluster using on AWS EKS (version 1.15 or 1.16).
2. Deploy vault-secrets-webhook using Helm
3. Try to remove a webhook's pod : you should see it mutating itself

Additional context:
This bug is reproducible on both EKS v1.15 and v1.16.

Environment details:

• Kubernetes version (e.g. v1.10.2): v1.16.8-eks-e16311
• Cloud-provider/provisioner (e.g. AKS, GKE, EKS, PKE etc): EKS
• bank-vaults version (e.g. 0.4.17): 1.2.0
• Install method (e.g. helm or static manifests): helm (chart version: 1.2.0)
• Logs from the misbehaving component (and any other relevant logs):
• Resource definition (possibly in YAML format) that caused the issue, without sensitive data:

Buggy MutatingWebhookConfiguration deployed on EKS v.1.16

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  creationTimestamp: "2020-05-15T16:17:22Z"
  generation: 4
  name: vault-secrets-webhook
  resourceVersion: "58544780"
  selfLink: /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/vault-secrets-webhook
  uid: adf7eddb-350a-4c56-bf75-f907153ce678
webhooks:
- admissionReviewVersions:
  - v1beta1
  clientConfig:
    caBundle: REDACTED
    service:
      name: vault-secrets-webhook
      namespace: REDACTED
      path: /pods
      port: 443
  failurePolicy: Ignore
  matchPolicy: Exact
  name: pods.vault-secrets-webhook.admission.banzaicloud.com
  namespaceSelector:
    matchExpressions:
    - key: name
      operator: NotIn
      values:
      - kube-system
    - key: name
      operator: NotIn
      values:
      - REDACTED
  objectSelector: {}
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - '*'
    apiVersions:
    - '*'
    operations:
    - CREATE
    resources:
    - pods
    scope: '*'
  sideEffects: Unknown
  timeoutSeconds: 30
- admissionReviewVersions:
  - v1beta1
  clientConfig:
    caBundle: REDACTED
    service:
      name: vault-secrets-webhook
      namespace: REDACTED
      path: /secrets
      port: 443
  failurePolicy: Ignore
  matchPolicy: Exact
  name: secrets.vault-secrets-webhook.admission.banzaicloud.com
  namespaceSelector:
    matchExpressions:
    - key: name
      operator: NotIn
      values:
      - kube-system
    - key: name
      operator: NotIn
      values:
      - REDACTED
  objectSelector: {}
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - '*'
    apiVersions:
    - '*'
    operations:
    - CREATE
    - UPDATE
    resources:
    - secrets
    scope: '*'
  sideEffects: Unknown
  timeoutSeconds: 30

/kind bug