Add webhook service to HCP allowlist (HOSTEDCP-1063)

Author: abyrne55

build/resources.go

@@ -609,6 +609,9 @@ func createService() *corev1.Service {
 			},
 			Labels: map[string]string{
 				"name": serviceName,
+				// hosted-cluster-config-operator label for HOSTEDCP-1063 compliance,
+				// i.e., adding our webhook's service to the HCP webhook allowlist
+				"hypershift.openshift.io/allow-guest-webhooks": "true",
 			},
 			Name:      serviceName,
 			Namespace: *namespace,

build/selectorsyncset.yaml

@@ -136,6 +136,7 @@ objects:
           service.beta.openshift.io/serving-cert-secret-name: webhook-cert
         creationTimestamp: null
         labels:
+          hypershift.openshift.io/allow-guest-webhooks: "true"
           name: validation-webhook
         name: validation-webhook
         namespace: openshift-validation-webhook

config/package/resources.yaml.gotmpl

@@ -16,6 +16,7 @@ metadata:
     service.beta.openshift.io/serving-cert-secret-name: webhook-cert
   creationTimestamp: null
   labels:
+    hypershift.openshift.io/allow-guest-webhooks: "true"
     name: validation-webhook
   name: validation-webhook
 spec: