Rejects admission for system namespaces

[DukeyToo]

The check for system namespaces rejects the admission request, even though the annotations are not present, because the namespace check occurs before the shouldInject check. This results in system components being unable to deploy.

vault-k8s/agent-inject/handler.go

Lines 120 to 124 in 15de548

	h.Log.Debug("checking namespaces..")
	if strutil.StrListContains(kubeSystemNamespaces, req.Namespace) {
	err := fmt.Errorf("error with request namespace: cannot inject into system namespaces: %s", req.Namespace)
	return admissionError(err)
	}

(the shouldInject check should happen prior to the namespace check)

[DukeyToo]

Looks like #24 will fix, if merged

[jasonodonnell]

#24 will be merged once reviewed and released. For now namespaceSelector should be utilized to scope the eligible namespaces for injection.

[jasonodonnell]

This has been fixed in vault-k8s:0.1.1, please update your injector deployment.