feat: add default namespace selector to ignore webhook namespace

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "protect-webhook"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 
 [dependencies]

charts/protect-webhook/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: protect-webhook
 description: A Helm chart for the Edera Protect Mutating Webhook
 type: application
-version: 0.1.1
-appVersion: "0.1.0"
+version: 0.1.2
+appVersion: "0.1.1"
 maintainers:
   - name: "Edera"
     url: "https://github.com/edera-dev"

charts/protect-webhook/README.md

@@ -1,6 +1,6 @@
 # protect-webhook
 
-![Version: 0.1.1](https://img.shields.io/badge/Version-0.1.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
+![Version: 0.1.2](https://img.shields.io/badge/Version-0.1.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.1](https://img.shields.io/badge/AppVersion-0.1.1-informational?style=flat-square)
 
 A Helm chart for the Edera Protect Mutating Webhook
 
@@ -35,8 +35,7 @@ A Helm chart for the Edera Protect Mutating Webhook
 | tolerations | list | `[]` | Webhook server tolerations |
 | volumeMounts | list | `[]` | Webhook server additional volume mounts |
 | volumes | list | `[]` | Webhook server additional volumes |
-| webhook | object | `{"objectSelector":{"matchLabels":{"dev.edera/inject-runtime":"true"}}}` | Mutating webhook configuration |
-| webhook.objectSelector | object | `{"matchLabels":{"dev.edera/inject-runtime":"true"}}` | This object selector lets you customize which labels you would like to filter on to inject the edera runtime class |
+| webhook | object | `{}` | Mutating webhook configuration |
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

charts/protect-webhook/templates/deployment.yaml

@@ -27,6 +27,9 @@ spec:
       {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- if .Values.runtimeClassName }}
+      runtimeClassName: {{ .Values.runtimeClassName }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           securityContext:

charts/protect-webhook/templates/webhook.yaml

@@ -15,6 +15,12 @@ webhooks:
         name: {{ include "protect-webhook.fullname" . }}
         namespace: {{ .Values.webhook.serviceNamespace | default .Release.Namespace }}
         path: /mutate
+    # Automatically exclude Edera resources
+    namespaceSelector:
+      matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: NotIn
+          values: [{{ .Release.Namespace }}]
     {{- if .Values.webhook }}
     {{- if .Values.webhook.objectSelector }}
     objectSelector:

charts/protect-webhook/values.yaml

@@ -16,6 +16,9 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+# -- Webhook server runtime class
+# runtimeClassName: edera
+
 # -- Webhook server pod annotations
 podAnnotations: {}
 
@@ -65,8 +68,8 @@ tolerations: []
 affinity: {}
 
 # -- Mutating webhook configuration
-webhook:
-  # -- This object selector lets you customize which labels you would like to filter on to inject the edera runtime class
-  objectSelector:
-    matchLabels:
-      dev.edera/inject-runtime: "true"
+webhook: {}
+  # This object selector lets you customize which labels you would like to filter on to inject the edera runtime class
+  # objectSelector:
+  #   matchLabels:
+  #     dev.edera/inject-runtime: "true"