Verify all images for managedseed

pkg/controller/lifecycle/actuator.go

@@ -162,6 +162,7 @@ func (a *actuator) Reconcile(ctx context.Context, logger logr.Logger, ex *extens
 		caBundleSecret.Data[secretutils.DataKeyCertificateBundle],
 		namespace,
 		lakomShootAccessSecret.ServiceAccountName,
+		cluster.Shoot.GetNamespace(),
 	)
 
 	if err != nil {
@@ -592,13 +593,13 @@ func getSeedResources(lakomReplicas *int32, namespace, genericKubeconfigName, sh
 	return resources, nil
 }
 
-func getShootResources(webhookCaBundle []byte, namespace, shootAccessServiceAccountName string) (map[string][]byte, error) {
+func getShootResources(webhookCaBundle []byte, extensionNamespace, shootAccessServiceAccountName, projectNamespace string) (map[string][]byte, error) {
 	var (
 		matchPolicy          = admissionregistration.Equivalent
 		sideEffectClass      = admissionregistration.SideEffectClassNone
 		failurePolicy        = admissionregistration.Fail
 		timeOutSeconds       = ptr.To[int32](25)
-		webhookHost          = fmt.Sprintf("https://%s.%s", constants.ExtensionServiceName, namespace)
+		webhookHost          = fmt.Sprintf("https://%s.%s", constants.ExtensionServiceName, extensionNamespace)
 		validatingWebhookURL = webhookHost + constants.LakomVerifyCosignSignaturePath
 		mutatingWebhookURL   = webhookHost + constants.LakomResolveTagPath
 		namespaceSelector    = metav1.LabelSelector{
@@ -610,6 +611,19 @@ func getShootResources(webhookCaBundle []byte, namespace, shootAccessServiceAcco
 				},
 			},
 		}
+		objectSelector = metav1.LabelSelector{}
+		rules          = []admissionregistration.RuleWithOperations{{
+			Operations: []admissionregistration.OperationType{admissionregistration.Create, admissionregistration.Update},
+			Rule: admissionregistration.Rule{
+				APIGroups:   []string{""},
+				APIVersions: []string{"v1"},
+				Resources:   []string{"pods", "pods/ephemeralcontainers"},
+			},
+		}}
+	)
+
+	isManagedSeed := projectNamespace == v1beta1constants.GardenNamespace
+	if !isManagedSeed {
 		objectSelector = metav1.LabelSelector{
 			MatchExpressions: []metav1.LabelSelectorRequirement{
 				{
@@ -619,15 +633,7 @@ func getShootResources(webhookCaBundle []byte, namespace, shootAccessServiceAcco
 				},
 			},
 		}
-		rules = []admissionregistration.RuleWithOperations{{
-			Operations: []admissionregistration.OperationType{admissionregistration.Create, admissionregistration.Update},
-			Rule: admissionregistration.Rule{
-				APIGroups:   []string{""},
-				APIVersions: []string{"v1"},
-				Resources:   []string{"pods", "pods/ephemeralcontainers"},
-			},
-		}}
-	)
+	}
 
 	shootRegistry := managedresources.NewRegistry(kubernetes.ShootScheme, kubernetes.ShootCodec, kubernetes.ShootSerializer)
 	shootResources, err := shootRegistry.AddAllAndSerialize(

pkg/controller/lifecycle/actuator_test.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"github.com/Masterminds/semver/v3"
+	v1beta1constants "github.com/gardener/gardener/pkg/apis/core/v1beta1/constants"
 	"github.com/gardener/gardener/pkg/resourcemanager/controller/garbagecollector/references"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -47,7 +48,8 @@ var _ = Describe("Actuator", func() {
 
 	Context("getShootResources", func() {
 		const (
-			namespace                     = "shoot--for--bar"
+			shootNamespace                = "garden-foo"
+			extensionNamespace            = "shoot--foo--bar"
 			shootAccessServiceAccountName = "extension-shoot-lakom-service-access"
 			validatingWebhookKey          = "validatingwebhookconfiguration____gardener-extension-shoot-lakom-service-shoot.yaml"
 			mutatingWebhookKey            = "mutatingwebhookconfiguration____gardener-extension-shoot-lakom-service-shoot.yaml"
@@ -60,47 +62,64 @@ var _ = Describe("Actuator", func() {
 
 		It("Should ensure the correct shoot resources are created", func() {
 
-			resources, err := getShootResources(caBundle, namespace, shootAccessServiceAccountName)
+			resources, err := getShootResources(caBundle, extensionNamespace, shootAccessServiceAccountName, shootNamespace)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(resources).To(HaveLen(4))
 
 			Expect(resources).To(Equal(map[string][]byte{
-				validatingWebhookKey: []byte(expectedSeedValidatingWebhook(caBundle, namespace)),
-				mutatingWebhookKey:   []byte(expectedShootMutatingWebhook(caBundle, namespace)),
+				validatingWebhookKey: []byte(expectedSeedValidatingWebhook(caBundle, extensionNamespace, false)),
+				mutatingWebhookKey:   []byte(expectedShootMutatingWebhook(caBundle, extensionNamespace, false)),
 				roleKey:              []byte(expectedShootRole()),
 				roleBindingKey:       []byte(expectedShootRoleBinding(shootAccessServiceAccountName)),
 			}))
 		})
 
 		DescribeTable("Should ensure the mutating webhook config is correctly set",
 			func(ca []byte, ns string) {
-				resources, err := getShootResources(ca, ns, shootAccessServiceAccountName)
+				resources, err := getShootResources(ca, ns, shootAccessServiceAccountName, shootNamespace)
 				Expect(err).ToNot(HaveOccurred())
 
 				mutatingWebhook, ok := resources[mutatingWebhookKey]
 				Expect(ok).To(BeTrue())
-				Expect(string(mutatingWebhook)).To(Equal(expectedShootMutatingWebhook(ca, ns)))
+				Expect(string(mutatingWebhook)).To(Equal(expectedShootMutatingWebhook(ca, ns, false)))
 			},
-			Entry("Global CA bundle and namespace name", caBundle, namespace),
+			Entry("Global CA bundle and namespace name", caBundle, extensionNamespace),
 			Entry("Custom CA bundle and namespace name", []byte("anotherCABundle"), "different-namespace"),
 		)
 
 		DescribeTable("Should ensure the validating webhook config is correctly set",
 			func(ca []byte, ns string) {
-				resources, err := getShootResources(ca, ns, shootAccessServiceAccountName)
+				resources, err := getShootResources(ca, ns, shootAccessServiceAccountName, shootNamespace)
 				Expect(err).ToNot(HaveOccurred())
 
 				validatingWebhook, ok := resources[validatingWebhookKey]
 				Expect(ok).To(BeTrue())
-				Expect(string(validatingWebhook)).To(Equal(expectedSeedValidatingWebhook(ca, ns)))
+				Expect(string(validatingWebhook)).To(Equal(expectedSeedValidatingWebhook(ca, ns, false)))
 			},
-			Entry("Global CA bundle and namespace name", caBundle, namespace),
+			Entry("Global CA bundle and namespace name", caBundle, extensionNamespace),
+			Entry("Custom CA bundle and namespace name", []byte("anotherCABundle"), "different-namespace"),
+		)
+
+		DescribeTable("Should return an empty object selector for the webhooks when shoot is in the garden namespace",
+			func(ca []byte, ns string) {
+				resources, err := getShootResources(ca, ns, shootAccessServiceAccountName, v1beta1constants.GardenNamespace)
+				Expect(err).ToNot(HaveOccurred())
+
+				mutatingWebhook, ok := resources[mutatingWebhookKey]
+				Expect(ok).To(BeTrue())
+				Expect(string(mutatingWebhook)).To(Equal(expectedShootMutatingWebhook(ca, ns, true)))
+
+				validatingWebhook, ok := resources[validatingWebhookKey]
+				Expect(ok).To(BeTrue())
+				Expect(string(validatingWebhook)).To(Equal(expectedSeedValidatingWebhook(ca, ns, true)))
+			},
+			Entry("Global CA bundle and namespace name", caBundle, extensionNamespace),
 			Entry("Custom CA bundle and namespace name", []byte("anotherCABundle"), "different-namespace"),
 		)
 
 		DescribeTable("Should ensure the rolebinding is correctly set",
 			func(saName string) {
-				resources, err := getShootResources(caBundle, namespace, saName)
+				resources, err := getShootResources(caBundle, extensionNamespace, saName, shootNamespace)
 				Expect(err).ToNot(HaveOccurred())
 
 				roleBinding, ok := resources[roleBindingKey]
@@ -203,9 +222,19 @@ hjZVcW2ygAvImCAULGph2fqGkNUszl7ycJH/Dntw4wMLSbstUZomqPuIVQ==
 	})
 })
 
-func expectedShootMutatingWebhook(caBundle []byte, namespace string) string {
+func expectedShootMutatingWebhook(caBundle []byte, namespace string, withEmptyObjectSelector bool) string {
 	caBundleEncoded := b64.StdEncoding.EncodeToString(caBundle)
 
+	objectSelector := ` {}`
+	if !withEmptyObjectSelector {
+		objectSelector = `
+    matchExpressions:
+    - key: resources.gardener.cloud/managed-by
+      operator: In
+      values:
+      - gardener`
+	}
+
 	return `apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
@@ -230,12 +259,7 @@ webhooks:
       operator: In
       values:
       - kube-system
-  objectSelector:
-    matchExpressions:
-    - key: resources.gardener.cloud/managed-by
-      operator: In
-      values:
-      - gardener
+  objectSelector:` + objectSelector + `
   rules:
   - apiGroups:
     - ""
@@ -252,9 +276,19 @@ webhooks:
 `
 }
 
-func expectedSeedValidatingWebhook(caBundle []byte, namespace string) string {
+func expectedSeedValidatingWebhook(caBundle []byte, namespace string, withEmptyObjectSelector bool) string {
 	caBundleEncoded := b64.StdEncoding.EncodeToString(caBundle)
 
+	objectSelector := ` {}`
+	if !withEmptyObjectSelector {
+		objectSelector = `
+    matchExpressions:
+    - key: resources.gardener.cloud/managed-by
+      operator: In
+      values:
+      - gardener`
+	}
+
 	return `apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
@@ -279,12 +313,7 @@ webhooks:
       operator: In
       values:
       - kube-system
-  objectSelector:
-    matchExpressions:
-    - key: resources.gardener.cloud/managed-by
-      operator: In
-      values:
-      - gardener
+  objectSelector:` + objectSelector + `
   rules:
   - apiGroups:
     - ""