This PR changes the scope of the mutatingwebhook created by admission-webhook:
pods created in a kubeflow user namespace (eg: a namespace labeled by the kubeflow profiles conventions) will be subject to this webhook
all other pods (those in namespace=kubeflow or completely external to kubeflow) will not be touched by this webhook
This has the beneficial side effect that, if the admission-webhook workload is broken, it will not block all pods in the entire kubernetes cluster from creating, as has been reported in the past. It will however still block all kubeflow user pods in user namespaces
This change was manually tested using the procedure described in #15. Automated tests will be added later as a separate task
See #15 for more detail
This PR changes the scope of the mutatingwebhook created by admission-webhook:
This has the beneficial side effect that, if the admission-webhook workload is broken, it will not block all pods in the entire kubernetes cluster from creating, as has been reported in the past. It will however still block all kubeflow user pods in user namespaces
This change was manually tested using the procedure described in #15. Automated tests will be added later as a separate task