NVIDIA / nodewright / 41515715965

84%

Build Type

push

github

Committed by web-flow

Commit Message

fix(operator)!: cache and grant only the webhook serving-cert Secret (#944)

Both Secret informers, on the reconcile manager and the webhook bootstrap
manager, now select the serving-cert Secret by metadata.name through
WebhookSecretCacheConfig, and the namespaced Role grants get, list, watch,
update, patch and delete on that name only. create keeps a rule of its own
because a create request carries no name to match against resourceNames.

The operator no longer caches Helm release history or image pull secrets,
and can no longer read them. The chart renders the resourceName from
webhook.secretName, so this chart needs an operator that sends the field
selector: an older operator's namespace-wide list is rejected and the
webhook never bootstraps.

Signed-off-by: Brian Lockwood <lockwobr@gmail.com>

Coverage Stats

14 of 18 new or added lines in 2 files covered. (77.78%)

2 existing lines in 1 file now uncovered.

10449 of 12445 relevant lines covered (83.96%)

7.68 hits per line