Repository navigation
Update linage webhook configuration - #1454
Conversation
WalkthroughUpdated the MutatingWebhookConfiguration template: replaced a mutation rule from vmclusters (operator.victoriametrics.com/v1beta1) to workloadmonitors (cozystack.io/v1alpha1) and added a new mutation rule for ingresses (networking.k8s.io/v1) under the lineage webhook. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant KAS as Kubernetes API Server
participant MWH as lineage.cozystack.io MutatingWebhook
rect rgb(235, 245, 255)
note over KAS,MWH: Create/Update WorkloadMonitor (cozystack.io/v1alpha1)
KAS->>MWH: AdmissionReview (WorkloadMonitor)
MWH-->>KAS: AdmissionResponse (mutations/patches or allow)
end
rect rgb(240, 255, 240)
note over KAS,MWH: Create/Update Ingress (networking.k8s.io/v1)
KAS->>MWH: AdmissionReview (Ingress)
MWH-->>KAS: AdmissionResponse (mutations/patches or allow)
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello Andrei Kvapil (@kvaps), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request refines the Cozystack controller's Kubernetes configurations to align with evolving resource management needs. It updates the mutating webhook to focus on Cozystack's native Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Signed-off-by: Andrei Kvapil <[email protected]>
40fe83a to
97f1b29
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the lineage mutating webhook configuration to intercept workloadmonitors and ingresses instead of vmclusters. It also expands the cozystack-controller's permissions to the dashboard.cozystack.io API group. My review identifies a couple of areas for improvement. First, removing the vmclusters webhook rule leaves behind dead code in the webhook handler that should be cleaned up. Second, the permissions granted to the controller are overly broad, and I recommend scoping them down following the principle of least privilege.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
packages/system/cozystack-controller/templates/mutatingwebhookconfiguration.yaml (1)
28-30: Ingress mutation rule added: confirm handler coverage and consider explicit webhook knobs
- Rule is correct for networking.k8s.io/v1 ingresses.
- Confirm /mutate-lineage handles Ingress and that failurePolicy: Fail is acceptable for ingress mutations.
Optionally add explicit timeouts/reinvocation/match policy to harden behavior:
admissionReviewVersions: ["v1"] sideEffects: None + timeoutSeconds: 5 + reinvocationPolicy: IfNeeded + matchPolicy: EquivalentIf ingress mutations are not universally needed, consider adding an objectSelector to limit scope to labeled ingresses.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
packages/system/cozystack-controller/templates/mutatingwebhookconfiguration.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (1)
packages/system/cozystack-controller/templates/mutatingwebhookconfiguration.yaml (1)
24-26: Switch to WorkloadMonitor (cozystack.io/v1alpha1): verified — CRD, scope, webhook and RBAC OK
- CRD: packages/system/cozystack-controller/templates/crds/cozystack.io_workloadmonitors.yaml — kind=WorkloadMonitor, plural=workloadmonitors, version=v1alpha1, scope=Namespaced (namespaceSelector applies).
- Webhook: internal/lineagecontrollerwebhook/webhook.go registers the handler at /mutate-lineage and Handle processes unstructured objects; MutatingWebhookConfiguration includes workloadmonitors.
- RBAC: packages/system/cozystack-controller/templates/rbac.yaml grants apiGroups: ['cozystack.io'] resources: [''] verbs: [''] — covers workloadmonitors.
1 participant
Signed-off-by: Andrei Kvapil [email protected]
What this PR does
Release note
Summary by CodeRabbit