feat: Ship DNSRecordSet MWC with the image bundle - #70
Merged
Conversation
Hand-authored MutatingWebhookConfiguration in infra can register admission against a dns-operator build that has no webhook server (failurePolicy Fail then blocks all DNS writes). Add an OCI path components/admission-webhooks versioned with the manager image, use Ignore so missing webhooks only degrade activity FQDNs, and document the Flux consume pattern for infra. Closes #69
ecv
approved these changes
Jul 28, 2026
Contributor
|
@mattdjenkinson dont think we should have the webhook use ignore mode. There's no self recovery of the behavior if things do fail. |
Contributor
Author
|
@scotwells will fix in a follow up! |
mattdjenkinson
added a commit
that referenced
this pull request
Jul 29, 2026
failurePolicy Ignore lets writes succeed without activity annotations and those audits never self-heal. Fail is safe now that the MWC ships with the same OCI tag as the manager (follow-up to #70).
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Infra previously registered the DNSRecordSet mutating webhook on the control-plane apiserver while production could still run an older dns-operator image with no webhook server. With
failurePolicy: Fail, that skew blocked every DNSRecordSet write for about an hour (infra#3688).This puts the MutatingWebhookConfiguration in
dns-operator-kustomizeatcomponents/admission-webhooks, so a tag without a webhook server cannot carry a registration Flux can apply (for examplev0.6.4has noconfig/webhookat all). The MWC points atdns-operator-webhook-service/datum-dns-systemwith no kustomize namespace transformer, so FluxtargetNamespacecannot rewrite the Service namespace. Same-cluster kind/replicator packaging underconfig/webhook/keeps working, and both paths usefailurePolicy: Ignoreso a missing server degrades activity FQDNs instead of taking down writes.Infra should re-enable admission with a thin Flux Kustomization pointing at this OCI path (same
OCIRepositorysemver as manager), not a hand-authored MWC. Service and TLS mounts stay as cluster glue.Test plan
kustomize build config/components/admission-webhooksshows MWC withIgnoreanddatum-dns-systemService refkustomize build config/overlays/replicatorincludes webhook Service/MWC withIgnorego test ./internal/webhook/...path: components/admission-webhooksfrom the same OCI tag as managerCloses #69
Related to #62