recording webhook: don't use the replica name to track pods being rec…

…orded, use labels instead

The recording webhook used to track container replicas in a sync.Map,
but its usage was problematic because:
    - all replicas were deleted in case any of replicas with the same
      generatedName were used. This meant replica numbers used for
      recorded policies were being reused and not all containers would
      end up having a recorded policy
    - if a replica was removed, the profilerecording would lose the
      status and finalizers
    - using the replica tracking in the sync.Map means that the webhook
      is maintaining its state, which it shouldn't. While this patch
      doesn't remove the state completely it reduces its usage.

Instead of the above, this patch maintains the finalizer and the status
as a combination of examining the pod being admitted as well as the
currently existing pods which are listed during admission.

The replica number is then always increasing by one e.g. across scaleups
or scaledowns of replicated pods.

Finally, because the webhook is watching all namespaces, but the
sync.Map was only storing plain names, let's also add namespace as a
prefix for the syncMap. This allows to empty the sync.Map once no pods
for a single recording exist, keeping the memory usage low over time.

bundle/manifests/spo-webhook_rbac.authorization.k8s.io_v1_clusterrole.yaml

@@ -12,6 +12,14 @@ rules:
   - events
   verbs:
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:

deploy/base/role.yaml

@@ -448,6 +448,14 @@ rules:
   - events
   verbs:
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:

deploy/helm/templates/static-resources.yaml

@@ -491,6 +491,14 @@ rules:
   - events
   verbs:
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:

deploy/namespace-operator.yaml

@@ -1569,6 +1569,14 @@ rules:
   - events
   verbs:
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:

deploy/openshift-dev.yaml

@@ -1569,6 +1569,14 @@ rules:
   - events
   verbs:
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:

deploy/operator.yaml

@@ -1569,6 +1569,14 @@ rules:
   - events
   verbs:
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:

deploy/webhook-operator.yaml

@@ -1423,6 +1423,14 @@ rules:
   - events
   verbs:
   - create
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:

internal/pkg/webhooks/recording/impl.go

@@ -19,12 +19,12 @@ package recording
 import (
 	"context"
 	"fmt"
-	"k8s.io/apimachinery/pkg/types"
 
 	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
@@ -43,6 +43,7 @@ type defaultImpl struct {
 type impl interface {
 	GetProfileRecording(ctx context.Context, name, namespace string) (*v1alpha1.ProfileRecording, error)
 	ListProfileRecordings(context.Context, ...client.ListOption) (*v1alpha1.ProfileRecordingList, error)
+	ListRecordedPods(ctx context.Context, inNs string, selector *metav1.LabelSelector) (*corev1.PodList, error)
 	UpdateResource(context.Context, logr.Logger, client.Object, string) error
 	UpdateResourceStatus(context.Context, logr.Logger, client.Object, string) error
 	SetDecoder(*admission.Decoder)
@@ -72,6 +73,30 @@ func (d *defaultImpl) ListProfileRecordings(
 	return profileRecordings, nil
 }
 
+func (d *defaultImpl) ListRecordedPods(
+	ctx context.Context,
+	inNs string,
+	selector *metav1.LabelSelector,
+) (*corev1.PodList, error) {
+	podList := &corev1.PodList{}
+
+	labelSelector, err := metav1.LabelSelectorAsSelector(selector)
+	if err != nil {
+		return nil, fmt.Errorf("get profile recording: %w", err)
+	}
+
+	opts := client.ListOptions{
+		LabelSelector: labelSelector,
+		Namespace:     inNs,
+	}
+
+	if err := d.client.List(ctx, podList, &opts); err != nil {
+		return nil, fmt.Errorf("list recorded pods: %w", err)
+	}
+
+	return podList, nil
+}
+
 func (d *defaultImpl) UpdateResource(
 	ctx context.Context,
 	logger logr.Logger,