Scope StatefulSet mutating webhook to MOCO resources

[arosh]

Summary

Add a Kustomize patch that applies an objectSelector to the StatefulSet mutating webhook, so only MOCO-created StatefulSets are targeted and non-MOCO users are unaffected.

Background

The StatefulSet mutating webhook currently applies cluster-wide. As mentioned at https://habr.com/ru/companies/flant/articles/969520/, if the MOCO webhook is unavailable, it can impact unrelated StatefulSet operations. We want to limit the webhook to MOCO-managed resources .

Changes

• Add a strategic merge patch that sets objectSelector with app.kubernetes.io/created-by=moco on the StatefulSet mutating webhook.
• Wire the patch into the webhook kustomization so the selector is applied during manifest build.

Notes

Currently, controller-gen's +kubebuilder:webhook marker does not support setting an objectSelector. That is why we add objectSelector as a Kustomize patch. See kubernetes-sigs/controller-tools#553

[Copilot]

Pull request overview

Scopes the StatefulSet mutating webhook to MOCO-managed StatefulSets by applying an objectSelector, reducing blast radius when the webhook is unavailable.

Changes:

• Add a strategic merge patch to set objectSelector.matchLabels on the StatefulSet mutating webhook.
• Wire the patch into config/webhook/kustomization.yaml so it’s applied during manifest generation.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
config/webhook/patches/statefulset_webhook_objectselector.yaml	Adds an objectSelector to limit which StatefulSets the mutating webhook applies to.
config/webhook/kustomization.yaml	Applies the new patch during Kustomize builds of webhook manifests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

patchesStrategicMerge is the legacy Kustomize mechanism and is discouraged in favor of patches with an explicit target (kind/name/field selectors), which tends to be clearer and more robust as configurations evolve. Consider switching to patches: with a target that selects kind: MutatingWebhookConfiguration and name: mutating-webhook-configuration.

Suggested change

	patchesStrategicMerge:
	- patches/statefulset_webhook_objectselector.yaml
	patches:
	- path: patches/statefulset_webhook_objectselector.yaml
	target:
	kind: MutatingWebhookConfiguration
	name: mutating-webhook-configuration

[arosh]

Currently, this project uses legacy patchesStrategicMerge. I have a plan to create a PR that apply kustomize edit fix after this PR.