Merge pull request #302 from mjlshen/OSD-22913

disable the service webhook for classic clusters

Author: openshift-merge-bot[bot]

README.md

@@ -82,7 +82,9 @@ type Webhook interface {
 	// SyncSetLabelSelector returns the label selector to use in the SyncSet.
 	// Return utils.DefaultLabelSelector() to stick with the default
 	SyncSetLabelSelector() metav1.LabelSelector
-	// HypershiftEnabled will return boolean value for hypershift enabled configurations
+	// ClassicEnabled will return true if the webhook should be deployed to OSD/ROSA Classic clusters
+	ClassicEnabled() bool
+	// HypershiftEnabled will return true if the webhook should be deployed to ROSA HCP clusters
 	HypershiftEnabled() bool
 }
 ```
@@ -117,7 +119,7 @@ The [utils package](pkg/webhooks/utils/utils.go) provides a string slice content
 
 ### Mutating Webhooks
 
-Despite its name, this repository has basic support for deploying mutating webhooks alongside validating ones due to their similarity. The differences between the two webhook types boil down to the types of decisions (`Response`s) they're allowed to return to the API server. Just like validating webhooks, mutating webhooks can decide that a request is `Allowed`, `Denied`, or `Errored` (see *[Building a Response](#building-a-response)* below). Unlike validating webhooks, however, mutating webhooks may instead decide that a request can be allowed only if some changes are made (i.e., `Patched`). `Patched` decisions contain a RFC 6902 ([JSONPatch](https://jsonpatch.com/)) string that describes the necessary mutations. 
+Despite its name, this repository has basic support for deploying mutating webhooks alongside validating ones due to their similarity. The differences between the two webhook types boil down to the types of decisions (`Response`s) they're allowed to return to the API server. Just like validating webhooks, mutating webhooks can decide that a request is `Allowed`, `Denied`, or `Errored` (see *[Building a Response](#building-a-response)* below). Unlike validating webhooks, however, mutating webhooks may instead decide that a request can be allowed only if some changes are made (i.e., `Patched`). `Patched` decisions contain a RFC 6902 ([JSONPatch](https://jsonpatch.com/)) string that describes the necessary mutations.
 
 For example, the [service-mutation webhook](pkg/webhooks/service/service.go) enforces an AWS managed policy requirement that ELBs are tagged with `red-hat-managed=true` by mutating all CREATE and UPDATE operations on LoadBalancer-type `Services` such that they contain the annotation `service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: red-hat-managed=true`. For a CREATE operation on a `Service` that's missing the necessary annotation, the JSONPatch embedded within the `Patched` Response might look like:
 

build/resources.go

@@ -806,6 +806,10 @@ func main() {
 			}
 			seen[hook().GetURI()] = true
 
+			if !hook().ClassicEnabled() {
+				continue
+			}
+
 			// no rules...?
 			if len(hook().Rules()) == 0 {
 				continue

build/selectorsyncset.yaml

@@ -721,37 +721,6 @@ objects:
           scope: Cluster
         sideEffects: None
         timeoutSeconds: 2
-    - apiVersion: admissionregistration.k8s.io/v1
-      kind: MutatingWebhookConfiguration
-      metadata:
-        annotations:
-          service.beta.openshift.io/inject-cabundle: "true"
-        creationTimestamp: null
-        name: sre-service-mutation
-      webhooks:
-      - admissionReviewVersions:
-        - v1
-        clientConfig:
-          service:
-            name: validation-webhook
-            namespace: openshift-validation-webhook
-            path: /service-mutation
-        failurePolicy: Ignore
-        matchPolicy: Equivalent
-        name: service-mutation.managed.openshift.io
-        rules:
-        - apiGroups:
-          - ""
-          apiVersions:
-          - v1
-          operations:
-          - CREATE
-          - UPDATE
-          resources:
-          - services
-          scope: Namespaced
-        sideEffects: None
-        timeoutSeconds: 2
     - apiVersion: admissionregistration.k8s.io/v1
       kind: ValidatingWebhookConfiguration
       metadata:

pkg/config/namespaces.go

@@ -281,6 +281,8 @@ func (s *ClusterloggingWebhook) SyncSetLabelSelector() metav1.LabelSelector {
 	return customLabelSelector
 }
 
+func (s *ClusterloggingWebhook) ClassicEnabled() bool { return true }
+
 func (s *ClusterloggingWebhook) HypershiftEnabled() bool { return false }
 
 // NewWebhook creates a new webhook

pkg/webhooks/clusterlogging/clusterlogging.go

@@ -243,4 +243,6 @@ func (s *ClusterRoleBindingWebHook) SyncSetLabelSelector() metav1.LabelSelector
 	return utils.DefaultLabelSelector()
 }
 
+func (s *ClusterRoleBindingWebHook) ClassicEnabled() bool { return true }
+
 func (s *ClusterRoleBindingWebHook) HypershiftEnabled() bool { return true }

pkg/webhooks/clusterrolebinding/clusterrolebinding.go

@@ -193,4 +193,6 @@ func (s *customresourcedefinitionsruleWebhook) SyncSetLabelSelector() metav1.Lab
 	return utils.DefaultLabelSelector()
 }
 
+func (s *customresourcedefinitionsruleWebhook) ClassicEnabled() bool { return true }
+
 func (s *customresourcedefinitionsruleWebhook) HypershiftEnabled() bool { return false }

pkg/webhooks/customresourcedefinitions/customresourcedefinitions.go

@@ -130,6 +130,8 @@ func (s *HiveOwnershipWebhook) SyncSetLabelSelector() metav1.LabelSelector {
 	return utils.DefaultLabelSelector()
 }
 
+func (s *HiveOwnershipWebhook) ClassicEnabled() bool { return true }
+
 func (s *HiveOwnershipWebhook) HypershiftEnabled() bool { return false }
 
 // NewWebhook creates a new webhook

pkg/webhooks/hiveownership/hiveownership.go

@@ -165,6 +165,10 @@ func (w *ImageContentPoliciesWebhook) SyncSetLabelSelector() metav1.LabelSelecto
 	return utils.DefaultLabelSelector()
 }
 
+func (w *ImageContentPoliciesWebhook) ClassicEnabled() bool {
+	return true
+}
+
 func (w *ImageContentPoliciesWebhook) HypershiftEnabled() bool {
 	return true
 }

pkg/webhooks/imagecontentpolicies/imagecontentpolicies.go

@@ -122,6 +122,8 @@ func (w *IngressConfigWebhook) SyncSetLabelSelector() metav1.LabelSelector {
 	return utils.DefaultLabelSelector()
 }
 
+func (w *IngressConfigWebhook) ClassicEnabled() bool { return true }
+
 // HypershiftEnabled will return boolean value for hypershift enabled configurations
 func (w *IngressConfigWebhook) HypershiftEnabled() bool { return true }