-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
mutatingWebhook is being flagged as unsafe #461
Comments
Thank you for reporting this. I agree that the operator has no reason to intercept pods in system namespaces, and I'd like to change the operator setup so that it works correctly. I have a suggestions on how to accomplish this:
|
I think this is a bug -- we shouldn't be causing GKE to flag the Operator. Adjusting the priority down, though, as it's not going to interfere with operations. |
Based on GKE's version support, I think v1.21 (April 8, 2021) is already unsupported. So we're good to use a > v1.21 solution here (i.e. namespaceSelector). Reference: https://cloud.google.com/kubernetes-engine/versioning#version-support |
The cloud-sql-proxy-operator mutating webhook can intercept pods in system-managed namespaces. Because of that GKE is flagging the webhook as unsafe.
From the GKE documentation:
The recommended action is to change the scope of the resources to
namespaced
from*
and exclude the system-managed namespaces with the help of thenamespaceSelector
on theMutatingWebhookConfiguration
resource (Since Kubernetes v1.21). However, I am not sure if this would affect any potential use cases of the cloud-sql-proxy-operator.What are your opinions on this?
The text was updated successfully, but these errors were encountered: