fix: users can patch namespaces not managed by capsule

Signed-off-by: Sagar Jadhav <sagarj2@vmware.com>

pkg/webhook/namespace/owner_reference.go

@@ -42,6 +42,10 @@ func (r *ownerReferenceHandler) OnUpdate(_ client.Client, decoder *admission.Dec
 			return utils.ErroredResponse(err)
 		}
 
+		if len(oldNs.OwnerReferences) == 0 {
+			return nil
+		}
+
 		newNs := &corev1.Namespace{}
 		if err := decoder.Decode(req, newNs); err != nil {
 			return utils.ErroredResponse(err)

pkg/webhook/namespace/patch.go

@@ -72,11 +72,6 @@ func (r *patchHandler) OnUpdate(c client.Client, decoder *admission.Decoder, rec
 
 				return &response
 			}
-		} else {
-			recorder.Eventf(ns, corev1.EventTypeWarning, "NamespacePatch", e)
-			response := admission.Denied(e)
-
-			return &response
 		}
 
 		return nil