Repository navigation
fix(controller): delete the webhook configuration of the old kind - #2152
Merged
Merged
Conversation
The controller created only the webhook configuration that matched spec.mutating. After a change of spec.mutating, the configuration of the old kind stayed in the cluster. Policy deletion removed only the configuration of the current kind. After the policy was deleted, the old configuration still sent requests to the policy server. The policy server answered 404, and the API server rejected the requests. Reconcile now deletes the configuration of the other kind after it creates the current one. The cleanup on policy deletion, on a rejected namespaced policy, and on a missing policy server now removes both kinds. Assisted-by: OpenCode (Claude Sonnet 5.5) Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues remain for the stale-webhook cleanup changes.
No open issues 🎉
What changed in this PR
Fixes #2149 by removing stale webhook configurations when a policy’s spec.mutating changes, preventing leftover webhooks from blocking requests after policy deletion.
Changes:
- Reconciles the current webhook kind before deleting the other kind.
- Updates shared cleanup to remove both mutating and validating webhook configurations.
- Adds unit tests for both policy kinds and webhook directions, plus an integration regression test for deletion with a stale webhook.
| File | Description |
|---|---|
internal/controller/policy_subreconciler.go |
Removes obsolete webhook kinds during reconciliation and both kinds during cleanup. |
internal/controller/policy_subreconciler_webhook_test.go |
Tests stale-webhook removal, cleanup of both kinds, and finalizer removal. |
Review effort: Balanced
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2152 +/- ##
==========================================
- Coverage 84.88% 82.36% -2.53%
==========================================
Files 148 203 +55
Lines 20675 25951 +5276
==========================================
+ Hits 17551 21374 +3823
- Misses 3124 4577 +1453
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
viccuad
reviewed
Nov 11, 2026
viccuad
left a comment
viccuad
left a comment
Member
There was a problem hiding this comment.
It looks good, I have silly quibbles, and one about not stopping after the first deletion if we have errors.
When the controller deletes the webhook configurations of a policy, it now tries to delete both kinds and returns the errors together. Before, an error on the first kind stopped the delete of the second kind. Also rename the function to deleteWebhookConfigurations and reuse newTestScheme in the tests. Assisted-by: OpenCode (Claude Opus 5.5) Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com>
jvanz
requested review from
flavio and
viccuad
and
a balanced review from Copilot
November 11, 2026 17:48
flavio
approved these changes
Nov 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The controller created only the webhook configuration that matched spec.mutating. After a change of spec.mutating, the configuration of the old kind stayed in the cluster. Policy deletion removed only the configuration of the current kind. After the policy was deleted, the old configuration still sent requests to the policy server. The policy server answered 404, and the API server rejected the requests.
Reconcile now deletes the configuration of the other kind after it creates the current one. The cleanup on policy deletion, on a rejected namespaced policy, and on a missing policy server now removes both kinds.
Fix #2149