fix

config/crd/bases/cluster.x-k8s.io_clusterclasses.yaml

@@ -796,12 +796,14 @@ spec:
                       type: string
                     external:
                       description: 'External defines an external patch. FIXME(sbueringer):
-                        internal or external only => validate'
+                        implement validation that exactly one of Definitions/External
+                        is set'
                       properties:
                         generateExtension:
-                          description: 'GenerateExtension references an extension
-                            which is called to generate patches. FIXME(sbueringer):
-                            Q: Fine that GenerateExtension is optional as well?'
+                          description: 'FIXME(sbueringer): implement validation that
+                            at least one of them is set if parent exists GenerateExtension
+                            references an extension which is called to generate patches.
+                            TBD here: https://vmware.slack.com/archives/C02TJ7SNQU8/p1654863214046059'
                           type: string
                         validateExtension:
                           description: GenerateExtension references an extension which

config/crd/bases/runtime.cluster.x-k8s.io_extensionconfigs.yaml

@@ -95,8 +95,8 @@ spec:
                     type: string
                 type: object
               namespaceSelector:
-                description: NamespaceSelector decides whether to run the webhook
-                  on an object based on whether the namespace for that object matches
+                description: NamespaceSelector decides whether to call the hook for
+                  an object based on whether the namespace for that object matches
                   the selector. Default to the empty LabelSelector, which matches
                   everything.
                 properties:

config/rbac/role.yaml

@@ -5,6 +5,14 @@ metadata:
   creationTimestamp: null
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - addons.cluster.x-k8s.io
   resources:

exp/runtime/internal/controllers/extensionconfig_controller.go

@@ -48,6 +48,7 @@ const (
 )
 
 // +kubebuilder:rbac:groups=runtime.cluster.x-k8s.io,resources=extensionconfigs;extensionconfigs/status,verbs=get;list;watch;patch;update
+// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch
 
 // Reconciler reconciles an ExtensionConfig object.
 type Reconciler struct {

poc/local/README.md

@@ -29,7 +29,7 @@ k apply -f ./poc/test/local/secure-infra.yaml
 
 # fetch certificate
 mkdir -p /tmp/k8s-webhook-server/serving-certs
-for f in $(kubectl get secret my-local-extension-cert -o json | jq '.data | keys | .[]' -r); do 
+for f in $(kubectl get secret webhook-service-cert -o json | jq '.data | keys | .[]' -r); do 
   kubectl get secret my-local-extension-cert -o json | jq '.data["'$f'"]' -r | base64 -d > "/tmp/k8s-webhook-server/serving-certs/$f"
 done