Merge pull request #249 from mengqiy/whitelist_ns

✨ default namespace selector for webhook
kubernetes-sigs · Dec 14, 2018 · b497fd5 · b497fd5
2 parents 40894d1 + 7d95fb1
commit b497fd5
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/pkg/webhook/bootstrap.go b/pkg/webhook/bootstrap.go
@@ -297,6 +297,17 @@ func (s *Server) validatingWHConfigs() (runtime.Object, error) {
 }
 
 func (s *Server) admissionWebhook(path string, wh *admission.Webhook) (*admissionregistration.Webhook, error) {
+	if wh.NamespaceSelector == nil && len(s.Service.Namespace) > 0 {
+		wh.NamespaceSelector = &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "control-plane",
+					Operator: metav1.LabelSelectorOpDoesNotExist,
+				},
+			},
+		}
+	}
+
 	webhook := &admissionregistration.Webhook{
 		Name:              wh.GetName(),
 		Rules:             wh.Rules,