Merge pull request #532 from redhatrises/fix_714

fix(admission): version 7.14 of admission controller requires webhook to exist before the service can start
CrowdStrike · May 1, 2024 · 1bc7ae9 · 1bc7ae9
2 parents fcb9706 + f30e751
commit 1bc7ae9
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 5 deletions.
diff --git a/internal/controller/admission/falconadmission_controller.go b/internal/controller/admission/falconadmission_controller.go
@@ -234,6 +234,11 @@ func (r *FalconAdmissionReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		return ctrl.Result{}, err
 	}
 
+	webhookUpdated, err := r.reconcileAdmissionValidatingWebHook(ctx, req, log, falconAdmission, admissionTLSSecret.Data["ca.crt"])
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+
 	err = r.reconcileAdmissionDeployment(ctx, req, log, falconAdmission)
 	if err != nil {
 		return ctrl.Result{}, err
@@ -252,11 +257,6 @@ func (r *FalconAdmissionReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
 	}
 
-	webhookUpdated, err := r.reconcileAdmissionValidatingWebHook(ctx, req, log, falconAdmission, admissionTLSSecret.Data["ca.crt"])
-	if err != nil {
-		return ctrl.Result{}, err
-	}
-
 	if configUpdated || serviceUpdated || webhookUpdated {
 		err = r.admissionDeploymentUpdate(ctx, req, log, falconAdmission)
 		if err != nil {

diff --git a/internal/controller/assets/validatingwebhook.go b/internal/controller/assets/validatingwebhook.go
@@ -2,6 +2,7 @@ package assets
 
 import (
 	"github.com/crowdstrike/falcon-operator/pkg/common"
+	"golang.org/x/exp/maps"
 	arv1 "k8s.io/api/admissionregistration/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -17,6 +18,12 @@ func ValidatingWebhook(name string, namespace string, webhookName string, caBund
 	scope := arv1.AllScopes
 	admissionOperatorValues := []string{"disabled"}
 	labels := common.CRLabels("validatingwebhook", name, common.FalconAdmissionController)
+	helmLabels := map[string]string{
+		"app":                         "falcon-kac",
+		"app.kubernetes.io/name":      "falcon-kac",
+		"app.kubernetes.io/component": "kac",
+	}
+	maps.Copy(labels, helmLabels)
 
 	return &arv1.ValidatingWebhookConfiguration{
 		TypeMeta: metav1.TypeMeta{

diff --git a/internal/controller/assets/validatingwebhook_test.go b/internal/controller/assets/validatingwebhook_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/crowdstrike/falcon-operator/pkg/common"
 	"github.com/google/go-cmp/cmp"
+	"golang.org/x/exp/maps"
 	arv1 "k8s.io/api/admissionregistration/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -30,6 +31,12 @@ func testValidatingWebhook(name string, namespace string, webhookName string, ca
 	scope := arv1.AllScopes
 	admissionOperatorValues := []string{"disabled"}
 	labels := common.CRLabels("validatingwebhook", name, common.FalconAdmissionController)
+	helmLabels := map[string]string{
+		"app":                         "falcon-kac",
+		"app.kubernetes.io/name":      "falcon-kac",
+		"app.kubernetes.io/component": "kac",
+	}
+	maps.Copy(labels, helmLabels)
 
 	return &arv1.ValidatingWebhookConfiguration{
 		TypeMeta: metav1.TypeMeta{