Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ignore unmanaged namespaces in webhook validation for all resources. #6013

Merged
merged 1 commit into from
Sep 20, 2022

Conversation

naemono
Copy link
Contributor

@naemono naemono commented Sep 14, 2022

closes #5814

Allow non-Elasticsearch resources outside of managed namespaces to also be ignored by webhooks.

Testing

Ran with version/values:

managedNamespaces:
- default
image:
  repository: docker.elastic.co/eck-dev/eck-operator-mmontgomery
  tag: 2.5.0-SNAPSHOT-6288a5b0

When applying the following manifest:

apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: heartbeat
  namespace: elastic
spec:
  type: heartbeat
  version: 8.2.3
  elasticsearchRef:
    name: elasticsearch
  config:
    heartbeat.monitors:
    - type: tcp
      schedule: '@every 5s'
      hosts: ["elasticsearch-es-http.default.svc:9200"]
  deployment:
    replicas: 1

You can see the operator's webhook validation ignoring this resource.

[elastic-operator-0] {"log.level":"debug","@timestamp":"2022-09-13T20:55:15.492Z","log.logger":"controller-runtime.webhook.webhooks","message":"received request","service.version":"2.5.0-SNAPSHOT+6288a5b0","service.type":"eck","ecs.version":"1.4.0","webhook":"/validate-beat-k8s-elastic-co-v1beta1-beat","UID":"3e2be798-0bae-4fd7-a6f1-bc5d98adbcc8","kind":"beat.k8s.elastic.co/v1beta1, Kind=Beat","resource":{"group":"beat.k8s.elastic.co","version":"v1beta1","resource":"beats"}}
[elastic-operator-0] {"log.level":"debug","@timestamp":"2022-09-13T20:55:15.493Z","log.logger":"common-webhook","message":"Skip resource validation","service.version":"2.5.0-SNAPSHOT+6288a5b0","service.type":"eck","ecs.version":"1.4.0","name":"heartbeat","namespace":"elastic"}
[elastic-operator-0] {"log.level":"debug","@timestamp":"2022-09-13T20:55:15.493Z","log.logger":"controller-runtime.webhook.webhooks","message":"wrote response","service.version":"2.5.0-SNAPSHOT+6288a5b0","service.type":"eck","ecs.version":"1.4.0","webhook":"/validate-beat-k8s-elastic-co-v1beta1-beat","code":200,"reason":"","UID":"3e2be798-0bae-4fd7-a6f1-bc5d98adbcc8","allowed":true}

@naemono naemono added >bug Something isn't working >enhancement Enhancement of existing functionality labels Sep 14, 2022
@naemono
Copy link
Contributor Author

naemono commented Sep 14, 2022

run/e2e-tests

@thbkrkr thbkrkr self-assigned this Sep 20, 2022
Copy link
Contributor

@thbkrkr thbkrkr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@naemono naemono merged commit 8662b11 into elastic:main Sep 20, 2022
@naemono naemono deleted the 5814-webhook-ns-aware-v2 branch September 20, 2022 13:46
@thbkrkr thbkrkr added v2.5.0 and removed >enhancement Enhancement of existing functionality labels Sep 27, 2022
fantapsody pushed a commit to fantapsody/cloud-on-k8s that referenced this pull request Feb 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
>bug Something isn't working v2.5.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Webhook namespace awareness is only implemented in Elasticsearch
2 participants