Move management of webhook configurations to operator #105
Conversation
openshift-ci-robot
added
the
size/L
| return nil, err | ||
| } | ||
|
|
||
| failurePolicy := admissionregistrationv1beta1.Ignore |
There was a problem hiding this comment.
Why should this be ignore?
There was a problem hiding this comment.
Because the validations are really (or will be when we're not doing allow-all) a nice-to-have. We have OpenAPI validation on the fields where we're able to do that, and other errors will be reported in events or in status conditions after the resource is created. So, we shouldn't completely block the functioning of the operator if the connection to the webhook server is not working -- e.g. if there's some transient networking issue.
This moves the management of the webhook configurations under the control of the operator rather than the CVO. Unfortunately the CA bundle fields in the webhook configurations are not known until runtime. If the CVO manages the configuration resources, the CA field cannot be updated as the CVO would overwrite any changes.
|
more context https://coreos.slack.com/archives/C68TNFWA2/p1561560240498300 on why this is needed |
|
This will only create the webhook once and won't take care of reconciling/recreation. If we find no way to drive this via cvo we'll need to make it more robust via local controller soon. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: enxebre The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
|
/lgtm |
This moves the management of the webhook configurations under the
control of the operator rather than the CVO. Unfortunately the CA
bundle fields in the webhook configurations are not known until
runtime. If the CVO manages the configuration resources, the CA field
cannot be updated as the CVO would overwrite any changes.