add the validatingWEbhookConfiguration disabler and permissions

charts/datree-admission-webhook/templates/clusterrole.yaml

@@ -8,6 +8,13 @@ metadata:
   annotations: {{ toYaml . | nindent 4 }}
   {{- end }}
 rules:
+  - apiGroups:
+      - "admissionregistration.k8s.io"
+    resources:
+      - "validatingwebhookconfigurations"
+    verbs:
+      - "get"  
+      - "update"
   - apiGroups:
       - "user.openshift.io"
     resources:

charts/datree-admission-webhook/templates/webhook-with-cert-secrets.yaml

@@ -31,6 +31,8 @@ webhooks:
       matchExpressions:
         - key: admission.datree/validate
           operator: DoesNotExist
+        - key: admission.datree/validate
+          operator: Exists # the label can't exist AND not exist simultaneously, therefore the webhook will never be invoked until we delete this expression
     rules:
       - operations: ["CREATE", "UPDATE"]
         apiGroups: ["*"]