fix: allow administrator operations on tenant namespaces (#2037)

fix: allow administrator operations on tenant namespaces 

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

internal/controllers/cfg/status/manager.go

@@ -116,7 +116,7 @@ func (r *Manager) SetupWithManager(
 				CreateFunc: func(e event.CreateEvent) bool {
 					to, ok := e.Object.(*capsulev1beta2.TenantOwner)
 
-					return ok && to.Spec.Aggregate
+					return ok && to.Spec.AggregateEnabled()
 				},
 				UpdateFunc: func(e event.UpdateEvent) bool {
 					oldTo, ok1 := e.ObjectOld.(*capsulev1beta2.TenantOwner)
@@ -126,7 +126,7 @@ func (r *Manager) SetupWithManager(
 						return false
 					}
 
-					if oldTo.Spec.Aggregate != newTo.Spec.Aggregate {
+					if oldTo.Spec.AggregateEnabled() != newTo.Spec.AggregateEnabled() {
 						return true
 					}
 
@@ -143,7 +143,7 @@ func (r *Manager) SetupWithManager(
 				DeleteFunc: func(e event.DeleteEvent) bool {
 					to, ok := e.Object.(*capsulev1beta2.TenantOwner)
 
-					return ok && to.Spec.Aggregate
+					return ok && to.Spec.AggregateEnabled()
 				},
 			}),
 		).
@@ -231,7 +231,7 @@ func (r *Manager) gatherCapsuleUsers(
 	for i := range toList.Items {
 		to := &toList.Items[i]
 
-		if !to.Spec.Aggregate {
+		if !to.Spec.AggregateEnabled() {
 			continue
 		}
 

internal/webhook/namespace/mutation/metadata.go

@@ -185,15 +185,6 @@ func (h *metadataHandler) resolveTenantForUpdate(
 			return nil, ad.ErroredResponse(err)
 		}
 
-		if tnt != nil {
-			return tnt, nil
-		}
-
-		tnt, err = tenant.GetTenantByLabels(ctx, reader, oldNs)
-		if err != nil {
-			return nil, ad.ErroredResponse(err)
-		}
-
 		return tnt, nil
 	}
 

internal/webhook/namespace/validation/handler.go

@@ -97,7 +97,7 @@ func (h *handler) OnDelete(
 		}
 
 		tnt, err := tenant.ResolveNamespaceTenant(ctx, reader, oldNs)
-		if err != nil {
+		if err != nil && !user.IsAdmin() {
 			return ad.ErroredResponse(err)
 		}
 
@@ -149,7 +149,7 @@ func (h *handler) OnUpdate(
 		}
 
 		oldTenant, err := tenant.ResolveNamespaceTenant(ctx, reader, oldNs)
-		if err != nil {
+		if err != nil && !user.IsAdmin() {
 			return ad.ErroredResponse(err)
 		}