feat(webhook): add additional check for initContainers

Harry Li · Harry Li · commit c85a4ccdd1d2 · 2025-08-18T19:31:30.000+08:00
diff --git a/pkg/scheduler/webhook.go b/pkg/scheduler/webhook.go
@@ -68,7 +68,7 @@ func (h *webhook) Handle(_ context.Context, req admission.Request) admission.Res
 	}
 	klog.Infof(template, pod.Namespace, pod.Name, pod.UID)
 	hasResource := false
-	for idx, ctr := range pod.Spec.Containers {
+	for idx, ctr := range append(pod.Spec.Containers, pod.Spec.InitContainers...) {
 		c := &pod.Spec.Containers[idx]
 		if ctr.SecurityContext != nil {
 			if ctr.SecurityContext.Privileged != nil && *ctr.SecurityContext.Privileged {

Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,7 @@ func (h *webhook) Handle(_ context.Context, req admission.Request) admission.Res`
`68`	`68`	`}`
`69`	`69`	`klog.Infof(template, pod.Namespace, pod.Name, pod.UID)`
`70`	`70`	`hasResource := false`
`71`		`- for idx, ctr := range pod.Spec.Containers {`
	`71`	`+ for idx, ctr := range append(pod.Spec.Containers, pod.Spec.InitContainers...) {`
`72`	`72`	`c := &pod.Spec.Containers[idx]`
`73`	`73`	`if ctr.SecurityContext != nil {`
`74`	`74`	`if ctr.SecurityContext.Privileged != nil && *ctr.SecurityContext.Privileged {`