feat: set the PDB webhook to be disabled by default temporarily for compatibility reasons (kubefleet-dev#556)

Author: michaelawyu

cmd/hubagent/options/options_test.go

@@ -728,6 +728,7 @@ func TestWebhookOptions(t *testing.T) {
 				GuardRailWhitelistedUsers:              "",
 				GuardRailDenyModifyMemberClusterLabels: false,
 				EnableWorkload:                         false,
+				EnablePDBs:                             true,
 				UseCertManager:                         false,
 			},
 		},
@@ -752,6 +753,7 @@ func TestWebhookOptions(t *testing.T) {
 				GuardRailWhitelistedUsers:              "user1,user2",
 				GuardRailDenyModifyMemberClusterLabels: true,
 				EnableWorkload:                         true,
+				EnablePDBs:                             true,
 				UseCertManager:                         true,
 			},
 		},
@@ -767,6 +769,7 @@ func TestWebhookOptions(t *testing.T) {
 				GuardRailWhitelistedUsers:              "",
 				GuardRailDenyModifyMemberClusterLabels: false,
 				EnableWorkload:                         false,
+				EnablePDBs:                             true,
 				UseCertManager:                         false,
 			},
 		},
@@ -782,6 +785,7 @@ func TestWebhookOptions(t *testing.T) {
 				GuardRailWhitelistedUsers:              "",
 				GuardRailDenyModifyMemberClusterLabels: false,
 				EnableWorkload:                         false,
+				EnablePDBs:                             true,
 				UseCertManager:                         false,
 			},
 		},

cmd/hubagent/options/webhooks.go

@@ -120,7 +120,8 @@ func (o *WebhookOptions) AddFlags(flags *flag.FlagSet) {
 	flags.BoolVar(
 		&o.EnablePDBs,
 		"enable-pdbs",
-		false,
+		// TO-DO (chenyu1): use the true value for compatibility reasons; this will be set to false in a later release.
+		true,
 		"Enable PodDisruptionBudgets to be created directly in the hub cluster or not. If set to true, the KubeFleet PodDisruptionBudget validating webhook, which blocks the creation of PodDisruptionBudgets outside KubeFleet reserved namespaces, will be disabled. This option only applies if webhooks are enabled.",
 	)
 

test/e2e/fleet_guard_rail_test.go

@@ -1168,6 +1168,8 @@ var _ = Describe("fleet guard rail webhook tests for PodDisruptionBudgets", Seri
 
 	Context("deny PDB operations in fleet-system namespace", func() {
 		It("should deny CREATE operation on PDB in fleet-system namespace for non-whitelisted users", func() {
+			Skip("PDB webhook is temporarily disabled.")
+
 			pdb := policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-pdb-fleet-system",
@@ -1191,6 +1193,8 @@ var _ = Describe("fleet guard rail webhook tests for PodDisruptionBudgets", Seri
 		)
 
 		BeforeAll(func() {
+			Skip("PDB webhook is temporarily disabled.")
+
 			mcName = fmt.Sprintf(mcNameTemplate, GinkgoParallelProcess())
 			imcNamespace = fmt.Sprintf(utils.NamespaceNameFormat, mcName)
 			createMemberCluster(mcName, testIdentity, nil, map[string]string{fleetClusterResourceIDAnnotationKey: clusterID1})
@@ -1202,6 +1206,8 @@ var _ = Describe("fleet guard rail webhook tests for PodDisruptionBudgets", Seri
 		})
 
 		It("should deny CREATE operation on PDB in fleet-member namespace for user not in MC identity", func() {
+			Skip("PDB webhook is temporarily disabled.")
+
 			pdb := policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-pdb-member",
@@ -1218,6 +1224,8 @@ var _ = Describe("fleet guard rail webhook tests for PodDisruptionBudgets", Seri
 		})
 
 		It("should deny UPDATE operation on PDB in fleet-member namespace for user not in MC identity", func() {
+			Skip("PDB webhook is temporarily disabled.")
+
 			// First create a PDB as admin.
 			pdb := policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
@@ -1255,6 +1263,8 @@ var _ = Describe("fleet guard rail webhook tests for PodDisruptionBudgets", Seri
 
 	Context("deny PDB operations in kube-system namespace", func() {
 		It("should deny CREATE operation on PDB in kube-system namespace for non-whitelisted users", func() {
+			Skip("PDB webhook is temporarily disabled.")
+
 			pdb := policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-pdb-kube",

test/e2e/webhook_test.go

@@ -1683,6 +1683,8 @@ var _ = Describe("webhook tests for ResourceOverride UPDATE operations", Ordered
 var _ = Describe("webhook tests for PodDisruptionBudget CREATE operations", func() {
 	Context("deny PDB creation in non-reserved namespaces", func() {
 		It("should deny CREATE operation on PDB in default namespace", func() {
+			Skip("PDB webhook is temporarily disabled.")
+
 			pdb := policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-pdb",
@@ -1707,6 +1709,8 @@ var _ = Describe("webhook tests for PodDisruptionBudget CREATE operations", func
 		})
 
 		It("should allow CREATE operation on PDB in kube-system namespace for master users", func() {
+			Skip("PDB webhook is temporarily disabled.")
+
 			pdb = policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-pdb-kube-system",