Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

spod: Make the webhook's ObjectSelector configurable #1232

Merged

Conversation

jhrozek
Copy link
Contributor

@jhrozek jhrozek commented Oct 14, 2022

What type of PR is this?

/kind feature
/kind api-change

What this PR does / why we need it:

Implements a suggestion from code review of the PR that made webhooks
opt-in. I wanted to document a way to make the objectSelector
configurable and to my surprise found out that this is not possible
because we don't implement configurable objectSelectors.

Which issue(s) this PR fixes:

None

Does this PR have test?

Yes.

Special notes for your reviewer:

I don't think we absulutely need this for 0.5.0, meaning that I wouldn't
delay the release.

Does this PR introduce a user-facing change?

The spod CR now has a new attribute objectSelector that allows to configure
which objects would SPO's webhooks match on. By default, the selector matches
all, but setting the selector to include e.g. only certain labels might be a way
to further ensure that possible bugs in the webhooks don't affect the rest of
the cluster.

Implements a suggestion from code review of the PR that made webhooks
opt-in. I wanted to document a way to make the objectSelector
configurable and to my surprise found out that this is not possible
because we don't implement configurable objectSelectors.
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API labels Oct 14, 2022
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. approved Indicates a PR has been approved by an approver from all required OWNERS files. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 14, 2022
@jhrozek
Copy link
Contributor Author

jhrozek commented Oct 14, 2022

In PR #1207, @ccojocar suggested that we should we document setting the objectSelector to further restrict the objects that the webhooks match. I was surprised to find out that we don't expose objectSelector, but only namespaceSelector, so I just went ahead and exposed the objectSelector as well.

I don't think we need to delay the 0.5.0 release over this, I just didn't want Cosmin's suggestion to get forgotten because I agree that in general it's a good idea to not overuse webhooks in a cluster.

Copy link
Contributor

@ccojocar ccojocar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks for adding this!

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 17, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhrozek, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [jhrozek,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot merged commit 15f4aba into kubernetes-sigs:main Oct 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants