From 78b0c32056a9c5787a2fb64ca92f54997a4037ff Mon Sep 17 00:00:00 2001 From: Sagar Jadhav Date: Thu, 23 Mar 2023 20:49:25 +0530 Subject: [PATCH] fix: users can patch namespaces not managed by capsule Signed-off-by: Sagar Jadhav --- pkg/webhook/namespace/owner_reference.go | 4 ++++ pkg/webhook/namespace/patch.go | 5 ----- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/pkg/webhook/namespace/owner_reference.go b/pkg/webhook/namespace/owner_reference.go index b38dd40c..7f4e2960 100644 --- a/pkg/webhook/namespace/owner_reference.go +++ b/pkg/webhook/namespace/owner_reference.go @@ -42,6 +42,10 @@ func (r *ownerReferenceHandler) OnUpdate(_ client.Client, decoder *admission.Dec return utils.ErroredResponse(err) } + if len(oldNs.OwnerReferences) == 0 { + return nil + } + newNs := &corev1.Namespace{} if err := decoder.Decode(req, newNs); err != nil { return utils.ErroredResponse(err) diff --git a/pkg/webhook/namespace/patch.go b/pkg/webhook/namespace/patch.go index 18f1e972..1f3fb18e 100644 --- a/pkg/webhook/namespace/patch.go +++ b/pkg/webhook/namespace/patch.go @@ -72,11 +72,6 @@ func (r *patchHandler) OnUpdate(c client.Client, decoder *admission.Decoder, rec return &response } - } else { - recorder.Eventf(ns, corev1.EventTypeWarning, "NamespacePatch", e) - response := admission.Denied(e) - - return &response } return nil