fix(controller): use ownerreferences without controller owner relation

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

controllers/tenant/manager.go

@@ -16,6 +16,7 @@ import (
 	"k8s.io/client-go/util/retry"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
@@ -31,11 +32,11 @@ type Manager struct {
 func (r *Manager) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&capsulev1beta2.Tenant{}).
-		Owns(&corev1.Namespace{}).
 		Owns(&networkingv1.NetworkPolicy{}).
 		Owns(&corev1.LimitRange{}).
 		Owns(&corev1.ResourceQuota{}).
 		Owns(&rbacv1.RoleBinding{}).
+		Watches(&corev1.Namespace{}, handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &capsulev1beta2.Tenant{})).
 		Complete(r)
 }
 

pkg/webhook/namespace/utils.go → pkg/utils/reference.go

@@ -1,7 +1,7 @@
 // Copyright 2020-2023 Project Capsule Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package namespace
+package utils
 
 import (
 	"strings"
@@ -15,7 +15,7 @@ const (
 	ObjectReferenceTenantKind = "Tenant"
 )
 
-func isTenantOwnerReference(or metav1.OwnerReference) bool {
+func IsTenantOwnerReference(or metav1.OwnerReference) bool {
 	parts := strings.Split(or.APIVersion, "/")
 	if len(parts) != 2 {
 		return false

pkg/webhook/namespace/freezed.go

@@ -15,6 +15,7 @@ import (
 
 	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
 	"github.com/projectcapsule/capsule/pkg/configuration"
+	capsuleutils "github.com/projectcapsule/capsule/pkg/utils"
 	capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
 	"github.com/projectcapsule/capsule/pkg/webhook/utils"
 )
@@ -35,7 +36,7 @@ func (r *freezedHandler) OnCreate(client client.Client, decoder admission.Decode
 		}
 
 		for _, objectRef := range ns.ObjectMeta.OwnerReferences {
-			if !isTenantOwnerReference(objectRef) {
+			if !capsuleutils.IsTenantOwnerReference(objectRef) {
 				continue
 			}
 

pkg/webhook/namespace/prefix.go

@@ -16,6 +16,7 @@ import (
 
 	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
 	"github.com/projectcapsule/capsule/pkg/configuration"
+	capsuleutils "github.com/projectcapsule/capsule/pkg/utils"
 	capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
 	"github.com/projectcapsule/capsule/pkg/webhook/utils"
 )
@@ -49,7 +50,7 @@ func (r *prefixHandler) OnCreate(clt client.Client, decoder admission.Decoder, r
 			tnt := &capsulev1beta2.Tenant{}
 
 			for _, or := range ns.ObjectMeta.OwnerReferences {
-				if !isTenantOwnerReference(or) {
+				if !capsuleutils.IsTenantOwnerReference(or) {
 					continue
 				}
 

pkg/webhook/namespace/quota.go

@@ -13,6 +13,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+	capsuleutils "github.com/projectcapsule/capsule/pkg/utils"
 	capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
 	"github.com/projectcapsule/capsule/pkg/webhook/utils"
 )
@@ -31,7 +32,7 @@ func (r *quotaHandler) OnCreate(client client.Client, decoder admission.Decoder,
 		}
 
 		for _, objectRef := range ns.ObjectMeta.OwnerReferences {
-			if !isTenantOwnerReference(objectRef) {
+			if !capsuleutils.IsTenantOwnerReference(objectRef) {
 				continue
 			}
 

pkg/webhook/namespace/user_metadata.go

@@ -15,6 +15,7 @@ import (
 
 	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
 	"github.com/projectcapsule/capsule/pkg/api"
+	capsuleutils "github.com/projectcapsule/capsule/pkg/utils"
 	capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
 	"github.com/projectcapsule/capsule/pkg/webhook/utils"
 )
@@ -35,7 +36,7 @@ func (r *userMetadataHandler) OnCreate(client client.Client, decoder admission.D
 		tnt := &capsulev1beta2.Tenant{}
 
 		for _, objectRef := range ns.ObjectMeta.OwnerReferences {
-			if !isTenantOwnerReference(objectRef) {
+			if !capsuleutils.IsTenantOwnerReference(objectRef) {
 				continue
 			}
 
@@ -90,7 +91,7 @@ func (r *userMetadataHandler) OnUpdate(client client.Client, decoder admission.D
 		tnt := &capsulev1beta2.Tenant{}
 
 		for _, objectRef := range newNs.ObjectMeta.OwnerReferences {
-			if !isTenantOwnerReference(objectRef) {
+			if !capsuleutils.IsTenantOwnerReference(objectRef) {
 				continue
 			}
 

pkg/webhook/networkpolicy/validating.go

@@ -6,14 +6,12 @@ package networkpolicy
 import (
 	"context"
 
-	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/record"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
-	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
 	capsuleutils "github.com/projectcapsule/capsule/pkg/utils"
 	capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
 	"github.com/projectcapsule/capsule/pkg/webhook/utils"
@@ -31,39 +29,14 @@ func (r *handler) OnCreate(client.Client, admission.Decoder, record.EventRecorde
 	}
 }
 
-func (r *handler) generic(ctx context.Context, req admission.Request, client client.Client, _ admission.Decoder) (*capsulev1beta2.Tenant, error) {
-	var err error
-
-	np := &networkingv1.NetworkPolicy{}
-	if err = client.Get(ctx, types.NamespacedName{Namespace: req.AdmissionRequest.Namespace, Name: req.AdmissionRequest.Name}, np); err != nil {
-		return nil, err
-	}
-
-	tnt := &capsulev1beta2.Tenant{}
-
-	l, _ := capsuleutils.GetTypeLabel(&capsulev1beta2.Tenant{})
-	if v, ok := np.GetLabels()[l]; ok {
-		if err = client.Get(ctx, types.NamespacedName{Name: v}, tnt); err != nil {
-			return nil, err
-		}
-
-		return tnt, nil
-	}
-
-	return nil, nil //nolint:nilnil
-}
-
-//nolint:dupl
-func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
+func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func {
 	return func(ctx context.Context, req admission.Request) *admission.Response {
-		tnt, err := r.generic(ctx, req, client, decoder)
+		allowed, err := r.handle(ctx, req, client, decoder)
 		if err != nil {
 			return utils.ErroredResponse(err)
 		}
 
-		if tnt != nil {
-			recorder.Eventf(tnt, corev1.EventTypeWarning, "NetworkPolicyDeletion", "NetworkPolicy %s/%s cannot be deleted", req.Namespace, req.Name)
-
+		if !allowed {
 			response := admission.Denied("Capsule Network Policies cannot be deleted: please, reach out to the system administrators")
 
 			return &response
@@ -73,17 +46,14 @@ func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, reco
 	}
 }
 
-//nolint:dupl
-func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
+func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func {
 	return func(ctx context.Context, req admission.Request) *admission.Response {
-		tnt, err := r.generic(ctx, req, client, decoder)
+		allowed, err := r.handle(ctx, req, client, decoder)
 		if err != nil {
 			return utils.ErroredResponse(err)
 		}
 
-		if tnt != nil {
-			recorder.Eventf(tnt, corev1.EventTypeWarning, "NetworkPolicyUpdate", "NetworkPolicy %s/%s cannot be updated", req.Namespace, req.Name)
-
+		if !allowed {
 			response := admission.Denied("Capsule Network Policies cannot be updated: please, reach out to the system administrators")
 
 			return &response
@@ -92,3 +62,24 @@ func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, reco
 		return nil
 	}
 }
+
+func (r *handler) handle(ctx context.Context, req admission.Request, client client.Client, _ admission.Decoder) (allowed bool, err error) {
+	allowed = true
+
+	np := &networkingv1.NetworkPolicy{}
+	if err = client.Get(ctx, types.NamespacedName{Namespace: req.AdmissionRequest.Namespace, Name: req.AdmissionRequest.Name}, np); err != nil {
+		return false, err
+	}
+
+	objectLabel, err := capsuleutils.GetTypeLabel(&networkingv1.NetworkPolicy{})
+	if err != nil {
+		return
+	}
+
+	labels := np.GetLabels()
+	if _, ok := labels[objectLabel]; ok {
+		allowed = false
+	}
+
+	return
+}

pkg/webhook/ownerreference/patching.go

@@ -75,13 +75,13 @@ func (h *handler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.
 		var refs []metav1.OwnerReference
 
 		for _, ref := range oldNs.OwnerReferences {
-			if utils.IsTenantOwnerReference(ref) {
+			if capsuleutils.IsTenantOwnerReference(ref) {
 				refs = append(refs, ref)
 			}
 		}
 
 		for _, ref := range newNs.OwnerReferences {
-			if !utils.IsTenantOwnerReference(ref) {
+			if !capsuleutils.IsTenantOwnerReference(ref) {
 				refs = append(refs, ref)
 			}
 		}