变异准入 webhook 静态命名空间选择器

Question

Does anyone know if there is a way to define static selectors based on the namespace name instead of label selectors? The reason is that some of the namespaces are created by an operator and I don't have any control over the labels.

Thanks Essey

Answer 1

Seems no, never heard, never found anything like that.

As per MutatingWebhookConfiguration docs property namespaceSelector has a type LabelSelector [meta/v1] that supports

.matchExpressions
matchExpressions is a list of label selector requirements. The requirements are ANDed.

and

.matchLabels
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

And in the end everything is dependent on labels .

For sure you saw these examples

Answer 2

Each namespace has the so-called well-known label kubernetes.io/metadata.name

So your namespaceSelector can be something like:

namespaceSelector:
  matchExpressions:
    - key: kubernetes.io/metadata.name
      operator: "In"
      values:
        - "staging"
        - "demo"