Excluding System Webhooks

[aaron-ballard-530]

Description

A way to not intercept system webhooks

Acceptance Criteria

GKE will not generate a warning about system webhooks being intercepted.

Describe Alternatives

None

Dependencies

N/A

Additional context

Estimates

For Maintainers Only or Hero Triaging this bug

Suggested Priority (P1,P2,P3,P4,P5):
Suggested T-Shirt size (S, M, L, XL, Unknown):

[tspearconquest]

Hi, this is already the case.
Here's how the first one looks in the helm templates

  rules:
  - operations: ["CREATE"]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
{{- if or .Values.ignoreNamespaces .Values.injectOnlyLabeledNamespaces }}
    scope: Namespaced
  namespaceSelector:
{{- if .Values.ignoreNamespaces }}
    matchExpressions:
      - key: kubernetes.io/metadata.name
        operator: NotIn
        values: {{ .Values.ignoreNamespaces | toJson }}
{{- end }}
{{- if .Values.injectOnlyLabeledNamespaces }}
    matchLabels:
      newrelic-metadata-injection: enabled
{{- end }}

By default, that subchart's values.yaml includes:

# -- This is a list of namespaces that will be ignored by the webhook.
ignoreNamespaces: ['kube-public', 'kube-node-lease', 'kube-system']

Perhaps someone has edited the values.yaml for your installation to exclude some namespaces specific to your environment, and it overrode this default value?

Also as a side note, it looks like you have 2 different webhooks serving the same function:

1. newrelic-bundle-nri-metadata-injection
2. newrelic-k8s-nri-metadata-injection

Do you have 2 copies of the new relic bundle chart installed, one called newrelic-bundle and one called newrelic-k8s?

[tspearconquest]

That being said, it does look like the third entry in your screenshot could benefit from some enhancement, because the Mutating Webhook Configuration has no namespaceSelector. Some cloud providers have tooling to mitigate this, for example Azure automatically adds a namespaceSelector which excludes the following, but it sounds like in your case GKE does not have this functionality.

  namespaceSelector:
    matchExpressions:
    - key: control-plane
      operator: NotIn
      values:
      - "true"
    - key: kubernetes.azure.com/managedby
      operator: NotIn
      values:
      - aks
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      operations:
        - CREATE
      resources:
        - pods