Set webhook failure policy to ensure CRDs are rejected when webhook is unavailable
@@ -547,9 +547,12 @@ func (app *virtAPIApp) createValidatingWebhook() error {
}
}
+ failurePolicy := admissionregistrationv1beta1.Fail
+
webHooks := []admissionregistrationv1beta1.Webhook{
{
Name: "virtualmachineinstances-create-validator.kubevirt.io",
+ FailurePolicy: &failurePolicy,
Rules: []admissionregistrationv1beta1.RuleWithOperations{{
Operations: []admissionregistrationv1beta1.OperationType{
admissionregistrationv1beta1.Create,
@@ -571,6 +574,7 @@ func (app *virtAPIApp) createValidatingWebhook() error {
},
{
Name: "virtualmachineinstances-update-validator.kubevirt.io",
+ FailurePolicy: &failurePolicy,
Rules: []admissionregistrationv1beta1.RuleWithOperations{{
Operations: []admissionregistrationv1beta1.OperationType{
admissionregistrationv1beta1.Update,
@@ -592,6 +596,7 @@ func (app *virtAPIApp) createValidatingWebhook() error {
},
{
Name: "virtualmachine-validator.kubevirt.io",
+ FailurePolicy: &failurePolicy,
Rules: []admissionregistrationv1beta1.RuleWithOperations{{
Operations: []admissionregistrationv1beta1.OperationType{
admissionregistrationv1beta1.Create,
@@ -614,6 +619,7 @@ func (app *virtAPIApp) createValidatingWebhook() error {
},
{
Name: "virtualmachinereplicaset-validator.kubevirt.io",
+ FailurePolicy: &failurePolicy,
Rules: []admissionregistrationv1beta1.RuleWithOperations{{
Operations: []admissionregistrationv1beta1.OperationType{
admissionregistrationv1beta1.Create,
@@ -636,6 +642,7 @@ func (app *virtAPIApp) createValidatingWebhook() error {
},
{
Name: "virtualmachinepreset-validator.kubevirt.io",
+ FailurePolicy: &failurePolicy,
Rules: []admissionregistrationv1beta1.RuleWithOperations{{
Operations: []admissionregistrationv1beta1.OperationType{
admissionregistrationv1beta1.Create,
@@ -658,6 +665,7 @@ func (app *virtAPIApp) createValidatingWebhook() error {
},
{
Name: "migration-create-validator.kubevirt.io",
+ FailurePolicy: &failurePolicy,
Rules: []admissionregistrationv1beta1.RuleWithOperations{{
Operations: []admissionregistrationv1beta1.OperationType{
admissionregistrationv1beta1.Create,
@@ -679,6 +687,7 @@ func (app *virtAPIApp) createValidatingWebhook() error {
},
{
Name: "migration-update-validator.kubevirt.io",
+ FailurePolicy: &failurePolicy,
Rules: []admissionregistrationv1beta1.RuleWithOperations{{
Operations: []admissionregistrationv1beta1.OperationType{
admissionregistrationv1beta1.Update,
